Play interactive tour

Edit tour

Windows Analysis Report https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe

Overview

General Information

Sample URL:	https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe
Analysis ID:	450578
Infos:
Most interesting Screenshot:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Enables driver privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries device information via Setup API

Queries disk information (often used to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6872 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe' > cmdline.out 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wget.exe (PID: 6988 cmdline: wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe' MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

Driver_Updater.exe (PID: 1088 cmdline: 'C:\Users\user\Desktop\download\Driver_Updater.exe' MD5: E0B9B386B29E117110318302CE973889)

Driver_Updater.tmp (PID: 6364 cmdline: 'C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp' /SL5='$3802C0,5249794,721408,C:\Users\user\Desktop\download\Driver_Updater.exe' MD5: 84DB4B4205F705DA71471DC6ECC061F5)

PCHelpSoftDriverUpdater.exe (PID: 6488 cmdline: 'C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe' /INSTALL MD5: BDB2972360FC3DC01C7A39BDEE2B4DED)

PCHelpSoftDriverUpdater.exe (PID: 6664 cmdline: 'C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe' /START MD5: BDB2972360FC3DC01C7A39BDEE2B4DED)

schtasks.exe (PID: 6624 cmdline: 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Schedule' /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 7020 cmdline: 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Monitoring' /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

HDMTray.exe (PID: 6272 cmdline: 'C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe' MD5: CA2A9C91909A669420DDB908B32A5E52)

HDMTray.exe (PID: 7164 cmdline: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe MD5: CA2A9C91909A669420DDB908B32A5E52)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-VFE8P.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-0IPJB.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000F.00000000.725252382.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000010.00000000.725405866.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000005.00000003.711277518.00000000053C3000.00000004.00000001.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000F.00000002.728141654.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000010.00000002.930022159.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
16.2.HDMTray.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
15.2.HDMTray.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
16.0.HDMTray.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
15.0.HDMTray.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
9.2.PCHelpSoftDriverUpdater.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
9.0.PCHelpSoftDriverUpdater.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
6.2.PCHelpSoftDriverUpdater.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
6.0.PCHelpSoftDriverUpdater.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 3 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-0IPJB.tmp	ReversingLabs: Detection: 17%
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp	ReversingLabs: Detection: 17%

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0080E3A8 CryptQueryObject,GetLastError,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CertFindCertificateInStore,GetLastError,CertFreeCertificateContext,CertCloseStore,CertFindAttribute,CryptMsgOpenToDecode,GetLastError,CryptMsgUpdate,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CertOpenStore,GetLastError,CertFindCertificateInStore,GetLastError,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,CryptMsgClose,		6_2_0080E3A8
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0080E3A8 CryptQueryObject,GetLastError,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CertFindCertificateInStore,GetLastError,CertFreeCertificateContext,CertCloseStore,CertFindAttribute,CryptMsgOpenToDecode,GetLastError,CryptMsgUpdate,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CertOpenStore,GetLastError,CertFindCertificateInStore,GetLastError,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,CryptMsgClose,		9_2_0080E3A8

Source: unknown	HTTPS traffic detected: 217.195.25.241:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.74.90:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.195.25.241:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.202.46.34:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.9.52.221:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.13.99:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0040B268 FindFirstFileW,FindClose,	4_2_0040B268
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0040AC9C GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040AC9C
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_005EA2D0 FindFirstFileW,GetLastError,	5_2_005EA2D0
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_0040CBFC FindFirstFileW,FindClose,	5_2_0040CBFC
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_00642484 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,	5_2_00642484
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_0040C630 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040C630
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0040D838 FindFirstFileW,FindClose,	6_2_0040D838
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0040D26C GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	6_2_0040D26C
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_00422428 FindFirstFileW,GetLastError,	6_2_00422428
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_009809F0 FindFirstFileW,GetLastError,	6_2_009809F0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_00421FEC FindFirstFileW,FindClose,	6_2_00421FEC
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_00422428 FindFirstFileW,GetLastError,	9_2_00422428
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0040D838 FindFirstFileW,FindClose,	9_2_0040D838
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_009809F0 FindFirstFileW,GetLastError,	9_2_009809F0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0040D26C GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	9_2_0040D26C

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 6_2_004200A8 GetLogicalDriveStringsW,QueryDosDeviceW,

6_2_004200A8

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 6_2_0096C988 GetLastError,HttpOpenRequestW,GetLastError,InternetQueryOptionW,GetLastError,InternetSetOptionW,GetLastError,HttpSendRequestW,GetLastError,Sleep,HttpSendRequestW,GetLastError,Sleep,HttpSendRequestW,GetLastError,HttpQueryInfoW,GetLastError,HttpQueryInfoW,GetLastError,InternetSetFilePointer,GetLastError,GetLastError,InternetReadFile,GetLastError,Sleep,InternetSetFilePointer,GetLastError,GetLastError,InternetReadFile,GetLastError,

6_2_0096C988

Source: global traffic

HTTP traffic detected: GET /install_success.cfm?redirectId=pchelpsoft/driver_updater_tracked.htm&target=https://www.pchelpsoft.com&dcid=216151425&purl=1&mkey1=DT_TRACK_ALL&tracking=DT_TRACK_ALL&mkey10=DT_TRACK_ALL HTTP/1.1Accept: */*User-Agent: Mozilla/5.0 (Windows; U)Connection: Keep-AliveCache-Control: no-cacheHost: webtools.pchelpsoft.com

Source: unknown

DNS traffic detected: queries for: webtools.avanquest.com

Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Driver_Updater.tmp, 00000005.00000003.711216425.0000000005368000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/gsrsaovsslca2018.crl0)
Source: Driver_Updater.tmp, 00000005.00000003.711216425.0000000005368000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: Driver_Updater.tmp, 00000005.00000003.711216425.0000000005368000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: wget.exe, 00000003.00000002.658841721.0000000000BC8000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: wget.exe, 00000003.00000002.658944123.0000000001446000.00000004.00000040.sdmp	String found in binary or memory: http://crl.sca1b.amazontrust.com/sca1b.crl
Source: wget.exe, 00000003.00000002.658944123.0000000001446000.00000004.00000040.sdmp	String found in binary or memory: http://crl.sca1b.amazontrust.com/sca1b.crlxe
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ev-server-g3.crl04
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ev-server-g3.crl0J
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932113971.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: http://crt.user
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0R
Source: Driver_Updater.tmp, 00000005.00000003.711216425.0000000005368000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsrsaovsslca20180V
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0E
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943548638.0000000005481000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0K
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingg20
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/roo
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Driver_Updater.tmp, 00000005.00000003.711216425.0000000005368000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt07
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt08
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Driver_Updater.tmp, 00000005.00000003.711216425.0000000005368000.00000004.00000001.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.943435773.0000000005443000.00000004.00000001.sdmp	String found in binary or memory: http://webtools.pchelpsoft.com/install_success.cfm?redirectId=pchelpsoft/driver_updater_tracked.htm&
Source: Driver_Updater.exe, 00000004.00000003.666874452.0000000002600000.00000004.00000001.sdmp, Driver_Updater.tmp, 00000005.00000003.714087786.00000000037CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.7-zip.org
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: Driver_Updater.exe, 00000004.00000003.666874452.0000000002600000.00000004.00000001.sdmp, Driver_Updater.tmp, 00000005.00000003.670609142.0000000003490000.00000004.00000001.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: Driver_Updater.exe, 00000004.00000003.667294481.0000000002740000.00000004.00000001.sdmp, Driver_Updater.tmp, Driver_Updater.tmp, 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: Driver_Updater.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: Driver_Updater.exe, 00000004.00000000.666488768.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000006.00000003.700611451.00000000029A4000.00000004.00000001.sdmp	String found in binary or memory: http://www.pchelpsoft.com
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: http://www.pchelpsoft.com/images/build-phone-banners/phone_activation.png
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000003.700689552.00000000029FC000.00000004.00000001.sdmp	String found in binary or memory: http://www.pchelpsoft.com/images/build-phone-banners/phone_activation.png1
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000003.700689552.00000000029FC000.00000004.00000001.sdmp	String found in binary or memory: http://www.pchelpsoft.com/images/build-phone-banners/phone_activation.pngA
Source: Driver_Updater.exe, 00000004.00000003.667294481.0000000002740000.00000004.00000001.sdmp, Driver_Updater.tmp	String found in binary or memory: http://www.remobjects.com/ps
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.731333460.0000000005478000.00000004.00000001.sdmp	String found in binary or memory: https://api.w.org/
Source: wget.exe, 00000003.00000002.658830174.0000000000BC0000.00000004.00000020.sdmp	String found in binary or memory: https://cdn.pchelpsoft
Source: wget.exe, 00000003.00000002.658944123.0000000001446000.00000004.00000040.sdmp	String found in binary or memory: https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	String found in binary or memory: https://notifications.avqtools.com03
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000003.700773560.0000000002A53000.00000004.00000001.sdmp	String found in binary or memory: https://notifications.avqtools.comy8
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943510156.000000000546C000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpc
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943510156.000000000546C000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpc94~
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943402184.0000000005438000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943402184.0000000005438000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/1
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/10_64.7z?partner=PCHelpSoftDriverUpdater&version=5.4.549&nocache=
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/10_64.jsonm
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/10_64.jsonx
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000003.700749769.0000000002A3D000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/api/
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943510156.000000000546C000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943594176.00000000054A3000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_642
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932113971.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64tual
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943594176.00000000054A3000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64x
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943594176.00000000054A3000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943594176.00000000054A3000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64B
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943510156.000000000546C000.00000004.00000001.sdmp	String found in binary or memory: https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64tG
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000003.700741717.0000000002A36000.00000004.00000001.sdmp	String found in binary or memory: https://stats.avqtools.com
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	String found in binary or memory: https://stats.avqtools.compf
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000003.700773560.0000000002A53000.00000004.00000001.sdmp	String found in binary or memory: https://subscriptions.avqtools.com
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	String found in binary or memory: https://subscriptions.avqtools.com03
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	String found in binary or memory: https://techsupport.smartpcupdate.com/
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	String found in binary or memory: https://techsupport.smartpcupdate.com/tracker/click/PCDU_54578/1/Install
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000003.700766150.0000000002A4C000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	String found in binary or memory: https://updates.avqtools.com
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	String found in binary or memory: https://webtools.avanquest.com/
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	String found in binary or memory: https://webtools.avanquest.com/5
Source: wget.exe, 00000003.00000002.658939024.0000000001440000.00000004.00000040.sdmp	String found in binary or memory: https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-home.htm
Source: Driver_Updater.tmp, 00000005.00000003.714304118.00000000025B2000.00000004.00000001.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-home.htmA/
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934050390.0000000002AA4000.00000004.00000001.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-renew.htm
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-support.htm
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-uninstall.htm
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934050390.0000000002AA4000.00000004.00000001.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-upsell.htm
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver_updater_buy.htm
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/pcc-cs-download.htm
Source: Driver_Updater.tmp, 00000005.00000003.711464692.0000000005421000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/pcc-cs-download.htmU
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_postinstall.htm
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932113971.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_postinstall.htmE
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_update_param.htm
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.933947398.0000000002A61000.00000004.00000001.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_update_param.htmp
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000003.700637042.00000000029C1000.00000004.00000001.sdmp	String found in binary or memory: https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_update_param.htmqB
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: https://www.globalsign.com/r
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: https://www.pchelpsoft.com
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943391760.0000000005430000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com&dcid=216151425&purl=1&mkey1=DT_TRACK_ALL&tracking=DT_TRACK_ALL&mkey10=DT_
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000003.731333460.0000000005478000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943402184.0000000005438000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/?mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALL
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943402184.0000000005438000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/?mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALLI
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.934050390.0000000002AA4000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/?mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALLcesM
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/S
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/company/eula/
Source: Driver_Updater.tmp, 00000005.00000003.714513888.000000000260A000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/company/eula/Q
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/company/eula/U
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/company/privacy-policy/
Source: Driver_Updater.tmp, 00000005.00000003.713688074.00000000036C8000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/company/privacy-policy/3
Source: PCHelpSoftDriverUpdater.exe, 00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/company/privacy-policy/U
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/de/company/eula/
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/de/company/privacy-policy/
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/es/company/eula/
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/es/company/privacy-policy/
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/fr/company/eula/
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/fr/company/privacy-policy/
Source: PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.pchelpsoft.com/product/pc-cleaner/
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.731333460.0000000005478000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/wp-json/
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.731333460.0000000005478000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.com/wp-json/wp/v2/pages/2
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	String found in binary or memory: https://www.pchelpsoft.compf

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: unknown	HTTPS traffic detected: 217.195.25.241:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.225.74.90:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.195.25.241:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.202.46.34:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.9.52.221:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.13.99:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0097D114 OpenProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,CloseHandle,FindCloseChangeNotification,		6_2_0097D114
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0097D114 OpenProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,CloseHandle,		9_2_0097D114

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 6_2_00975E04: GetSystemDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,

6_2_00975E04

Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004A0E28 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		4_2_004A0E28
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_005ED36C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		5_2_005ED36C

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

File created: C:\Windows\INF\c_monitor.PNF

Jump to behavior

Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004254D0	4_2_004254D0
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004A8660	4_2_004A8660
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0040ECB4	4_2_0040ECB4
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00431F50	4_2_00431F50
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_0041073E	5_2_0041073E
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_00640F38	5_2_00640F38
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_0040AFF4	5_2_0040AFF4
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_006B4ADC	6_2_006B4ADC
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_006CA378	6_2_006CA378
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0080E3A8	6_2_0080E3A8
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_006B5620	6_2_006B5620
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0096C988	6_2_0096C988
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0040BBE4	6_2_0040BBE4
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_00974C90	6_2_00974C90
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0080E3A8	9_2_0080E3A8
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0096C988	9_2_0096C988
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_006B4ADC	9_2_006B4ADC
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_00860E28	9_2_00860E28
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_006CA378	9_2_006CA378
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_00874898	9_2_00874898
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0084E9A0	9_2_0084E9A0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_00974C90	9_2_00974C90
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_00811070	9_2_00811070
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_006B5620	9_2_006B5620
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0040BBE4	9_2_0040BBE4

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: String function: 005D3C90 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: String function: 005EAD48 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: String function: 005F4020 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: String function: 005F3D9C appears 39 times
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: String function: 005D39AC appears 46 times
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: String function: 005BC634 appears 40 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 004CBB58 appears 65 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 0040A1C4 appears 70 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 00408664 appears 78 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 00427958 appears 37 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 004CB690 appears 50 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 00422E90 appears 77 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 0040B074 appears 99 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 00983B74 appears 240 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 0041208C appears 194 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 0040AF3C appears 204 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 0040AFC4 appears 41 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 005C4D60 appears 1496 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 005C4DF4 appears 32 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 00973F78 appears 52 times
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: String function: 00983D20 appears 110 times

Source: Driver_Updater.tmp.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Driver_Updater.tmp.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-ISR8J.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-ISR8J.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: is-1I08D.tmp.5.dr

Static PE information: Number of sections : 11 > 10

Source: Driver_Updater.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Driver_Updater.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Driver_Updater.tmp.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Driver_Updater.tmp.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Driver_Updater.tmp.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-ISR8J.tmp.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-ISR8J.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-ISR8J.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-1I08D.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: classification engine

Classification label: mal64.spyw.evad.win@20/76@9/6

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 6_2_004D70D0 GetLastError,FormatMessageW,

6_2_004D70D0

Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004A0E28 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	4_2_004A0E28
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_005ED36C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	5_2_005ED36C
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0097D888 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,CloseHandle,GetLastError,	6_2_0097D888
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0097D888 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetLastError,GetLastError,CloseHandle,FindCloseChangeNotification,GetLastError,	9_2_0097D888

Source: C:\Users\user\Desktop\download\Driver_Updater.exe

Code function: 4_2_0041A5FC GetDiskFreeSpaceW,

4_2_0041A5FC

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 6_2_005D3F64 CreateToolhelp32Snapshot,

6_2_005D3F64

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Code function: 5_2_00601C6C GetVersion,CoCreateInstance,

5_2_00601C6C

Source: C:\Users\user\Desktop\download\Driver_Updater.exe

Code function: 4_2_004A1700 FindResourceW,SizeofResource,LoadResource,LockResource,

4_2_004A1700

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

File created: C:\Program Files (x86)\PC HelpSoft Driver Updater

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\cmdline.out

Jump to behavior

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Mutant created: \Sessions\1\BaseNamedObjects\PCHelpSoftDriverUpdater
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Mutant created: \Sessions\1\BaseNamedObjects\PC HelpSoft Driver Updater PC HelpSoft
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Mutant created: \Sessions\1\BaseNamedObjects\HDMTray
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6996:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_01

Source: C:\Users\user\Desktop\download\Driver_Updater.exe

File created: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp

Jump to behavior

Source: Yara match	File source: 16.2.HDMTray.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.HDMTray.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.HDMTray.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.HDMTray.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.PCHelpSoftDriverUpdater.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.PCHelpSoftDriverUpdater.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PCHelpSoftDriverUpdater.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.PCHelpSoftDriverUpdater.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000000.725252382.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.725405866.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.711277518.00000000053C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.728141654.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.930022159.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-VFE8P.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-0IPJB.tmp, type: DROPPED

Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: NATS-DANO-ADD
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins-63-install
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: CANCEL-INSTALLING
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins+65-installing
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins+67-installed
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins-69-install-finally
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: jp-ocr-b-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: jp-ocr-hand-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: application/x-install-instructions
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ISO_6937-2-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /INSTALL
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 070-collect-start
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: Start with /INSTALL
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 20-update-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 040-client-start-success
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 030-client-start-failed
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 50-scan-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 010-client-start
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 60-restore-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /install /quiet /norestart
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 20-backup-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: application/vnd.adobe.air-application-installer-package+zip
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 10-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 80-no-installed
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: new-10-start
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: old-10-start
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /stat/install_ex
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /stat/install
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins+66.2-start-process
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: application/vnd.groove-help
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /stat/install_break
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 250-STARTTLS
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: res-10-start-
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: restatus-19-installing-
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: NATS-SEFI-ADD
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: NATS-DANO-ADD
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins-63-install
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: CANCEL-INSTALLING
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins+65-installing
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins+67-installed
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins-69-install-finally
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: jp-ocr-b-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: jp-ocr-hand-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: application/x-install-instructions
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ISO_6937-2-add
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /INSTALL
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 070-collect-start
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: Start with /INSTALL
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 20-update-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 040-client-start-success
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 030-client-start-failed
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 50-scan-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 010-client-start
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 60-restore-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /install /quiet /norestart
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 20-backup-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: application/vnd.adobe.air-application-installer-package+zip
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 10-started
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 80-no-installed
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: new-10-start
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: old-10-start
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /stat/install_ex
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /stat/install
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: ins+66.2-start-process
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: application/vnd.groove-help
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: /stat/install_break
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: 250-STARTTLS
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: res-10-start-
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: restatus-19-installing-
Source: PCHelpSoftDriverUpdater.exe	String found in binary or memory: NATS-SEFI-ADD

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe' > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe'
Source: unknown	Process created: C:\Users\user\Desktop\download\Driver_Updater.exe 'C:\Users\user\Desktop\download\Driver_Updater.exe'
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp 'C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp' /SL5='$3802C0,5249794,721408,C:\Users\user\Desktop\download\Driver_Updater.exe'
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process created: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe 'C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe' /INSTALL
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process created: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe 'C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe' /START
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Schedule' /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Monitoring' /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe 'C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe'	Jump to behavior
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp 'C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp' /SL5='$3802C0,5249794,721408,C:\Users\user\Desktop\download\Driver_Updater.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process created: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe 'C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe' /INSTALL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process created: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe 'C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe' /START	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Schedule' /F	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Monitoring' /F	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe 'C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe'	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

File written: C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\settings.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Automated click: Next >

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Driver_Updater.exe.3.dr	Static PE information: section name: .didata
Source: Driver_Updater.tmp.4.dr	Static PE information: section name: .didata
Source: is-ISR8J.tmp.5.dr	Static PE information: section name: .didata
Source: is-1I08D.tmp.5.dr	Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\wget.exe	Code function: 3_2_00BCA49E push eax; ret	3_2_00BCA5F9
Source: C:\Windows\SysWOW64\wget.exe	Code function: 3_2_00BCCB88 push eax; retf	3_2_00BCCB89
Source: C:\Windows\SysWOW64\wget.exe	Code function: 3_2_00BCA368 push eax; ret	3_2_00BCA5F9
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004A7000 push 004A70DEh; ret	4_2_004A70D6
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004A7980 push 004A7A43h; ret	4_2_004A7A3B
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0043007C push ecx; mov dword ptr [esp], eax	4_2_0043007D
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004990E0 push ecx; mov dword ptr [esp], edx	4_2_004990E1
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00456090 push ecx; mov dword ptr [esp], ecx	4_2_00456094
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00430094 push ecx; mov dword ptr [esp], eax	4_2_00430095
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00498144 push ecx; mov dword ptr [esp], edx	4_2_00498145
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0045A170 push ecx; mov dword ptr [esp], edx	4_2_0045A171
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00454110 push 00454166h; ret	4_2_0045415E
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004251C8 push ecx; mov dword ptr [esp], eax	4_2_004251CD
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0041A1D4 push ecx; mov dword ptr [esp], ecx	4_2_0041A1D8
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00459264 push ecx; mov dword ptr [esp], edx	4_2_00459265
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00430214 push ecx; mov dword ptr [esp], eax	4_2_00430215
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00494224 push 00494303h; ret	4_2_004942FB
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004223E4 push 004224E8h; ret	4_2_004224E0
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00458384 push ecx; mov dword ptr [esp], edx	4_2_00458385
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00458394 push ecx; mov dword ptr [esp], edx	4_2_00458395
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004953B0 push ecx; mov dword ptr [esp], edx	4_2_004953B1
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00493454 push ecx; mov dword ptr [esp], edx	4_2_00493457
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00458468 push ecx; mov dword ptr [esp], ecx	4_2_0045846C
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00499474 push ecx; mov dword ptr [esp], edx	4_2_00499475
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00457424 push ecx; mov dword ptr [esp], eax	4_2_00457426
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004544B0 push ecx; mov dword ptr [esp], edx	4_2_004544B1
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0048D548 push ecx; mov dword ptr [esp], edx	4_2_0048D54A
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0045A524 push ecx; mov dword ptr [esp], edx	4_2_0045A525
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00429520 push ecx; mov dword ptr [esp], edx	4_2_00429522
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_004595B8 push ecx; mov dword ptr [esp], edx	4_2_004595B9
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_00498608 push ecx; mov dword ptr [esp], edx	4_2_00498609

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-5TGG4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-0IPJB.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\wget.exe	File created: C:\Users\user\Desktop\download\Driver_Updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-VFE8P.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	File created: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-ISR8J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-NAFD7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-QQ8F9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\Users\user\AppData\Local\Temp\is-4K8QF.tmp\_isetup\_setup64.tmp	Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Schedule' /F

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater\Help.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater\PC HelpSoft Driver Updater.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater\PC HelpSoft Driver Updater on the Web.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater\Uninstall PC HelpSoft Driver Updater.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_00630418 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,SetActiveWindow,	5_2_00630418
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_005A57A4 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,MessageBoxW,SetActiveWindow,	5_2_005A57A4
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_005AC2F0 IsIconic,	6_2_005AC2F0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_005AC374 GetWindowLongW,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongW,SetWindowLongW,ShowWindow,ShowWindow,	6_2_005AC374
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_005AC2F0 IsIconic,	9_2_005AC2F0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_005AC374 GetWindowLongW,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongW,SetWindowLongW,ShowWindow,ShowWindow,	9_2_005AC374

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Manufacturer, Product FROM Win32_BaseBoard
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Manufacturer, Product FROM Win32_BaseBoard
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Manufacturer, Product FROM Win32_BaseBoard

Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes)

Show sources

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

WMI Queries: IWbemServices::ExecQuery - root\WMI : SELECT * FROM MSSmBios_RawSMBiosTables

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0009 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\0003 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0045 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}\0001 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{745a17a0-74d3-11d0-b6fe-00a0c90f57da}\0000 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0056 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\0002 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{72631e54-78a4-11d0-bcf7-00aa00b7b32a}\0000 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\0000 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0006 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0044 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e97b-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{36fc9e60-c465-11cf-8056-444553540000}\0001 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}\0057 name: DriverDesc	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}\0001 name: DriverDesc	Jump to behavior

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 9_2_0075A27C SetupDiGetDeviceRegistryPropertyW,GetLastError,GetLastError,

9_2_0075A27C

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Window / User API: threadDelayed 458

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-5TGG4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-ISR8J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-NAFD7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-QQ8F9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-4K8QF.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Evaded block: after key decision			graph_6-31210
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Evaded block: after key decision			graph_6-32187

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_6-31705

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-23995

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

API coverage: 9.8 %

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe TID: 6900

Thread sleep time: -45800s >= -30000s

Jump to behavior

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0040B268 FindFirstFileW,FindClose,	4_2_0040B268
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: 4_2_0040AC9C GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040AC9C
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_005EA2D0 FindFirstFileW,GetLastError,	5_2_005EA2D0
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_0040CBFC FindFirstFileW,FindClose,	5_2_0040CBFC
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_00642484 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,	5_2_00642484
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: 5_2_0040C630 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040C630
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0040D838 FindFirstFileW,FindClose,	6_2_0040D838
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_0040D26C GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	6_2_0040D26C
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_00422428 FindFirstFileW,GetLastError,	6_2_00422428
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_009809F0 FindFirstFileW,GetLastError,	6_2_009809F0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 6_2_00421FEC FindFirstFileW,FindClose,	6_2_00421FEC
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_00422428 FindFirstFileW,GetLastError,	9_2_00422428
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0040D838 FindFirstFileW,FindClose,	9_2_0040D838
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_009809F0 FindFirstFileW,GetLastError,	9_2_009809F0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: 9_2_0040D26C GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	9_2_0040D26C

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 6_2_004200A8 GetLogicalDriveStringsW,QueryDosDeviceW,

6_2_004200A8

Source: C:\Users\user\Desktop\download\Driver_Updater.exe

Code function: 4_2_004A162C GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

4_2_004A162C

Source: PCHelpSoftDriverUpdater.exe	Binary or memory string: VMware
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.944944855.0000000006540000.00000004.00000001.sdmp	Binary or memory string: DevBusDesc=VMwaref)_U
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945147685.0000000006583000.00000004.00000001.sdmp	Binary or memory string: DeviceDesc=Microsoft Hyper-V Generation Counter
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.933757981.00000000029E4000.00000004.00000001.sdmp	Binary or memory string: J16..........VMware SVGA II.ES1371.......[MS_VM
Source: Driver_Updater.exe, 00000004.00000002.724163867.0000000002510000.00000002.00000001.sdmp, Driver_Updater.tmp, 00000005.00000002.719342677.00000000027D0000.00000002.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934780220.0000000003230000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware, Inc.
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.944944855.0000000006540000.00000004.00000001.sdmp	Binary or memory string: vmware vmci host device
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.944944855.0000000006540000.00000004.00000001.sdmp	Binary or memory string: DevBusDesc=VMware64
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945719904.0000000006630000.00000004.00000001.sdmp	Binary or memory string: #DevBusDesc=VMware Virtual USB Mouse
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943548638.0000000005481000.00000004.00000001.sdmp	Binary or memory string: VMware, Inc.VMW71.00V.1398a
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945534071.000000000659E000.00000004.00000001.sdmp	Binary or memory string: 2DevDriverDesc=Microsoft Hyper-V Generation Counter
Source: wget.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000002.943435773.0000000005443000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943548638.0000000005481000.00000004.00000001.sdmp	Binary or memory string: VMware, Inc.VMW7P`I
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943548638.0000000005481000.00000004.00000001.sdmp	Binary or memory string: VMware, Inc.NoneV
Source: Driver_Updater.exe, 00000004.00000002.724163867.0000000002510000.00000002.00000001.sdmp, Driver_Updater.tmp, 00000005.00000002.719342677.00000000027D0000.00000002.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934780220.0000000003230000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a edVMware7,1
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.941262099.00000000048D3000.00000004.00000001.sdmp	Binary or memory string: 2DeviceDescRaw=Microsoft Hyper-V Generation Counter)
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945534071.000000000659E000.00000004.00000001.sdmp	Binary or memory string: 2RegDriverDesc=Microsoft Hyper-V Generation Counter
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945719904.0000000006630000.00000004.00000001.sdmp	Binary or memory string: VMware`
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.943548638.0000000005481000.00000004.00000001.sdmp	Binary or memory string: 4a edVMware7,1
Source: wget.exe, 00000003.00000002.658841721.0000000000BC8000.00000004.00000020.sdmp, PCHelpSoftDriverUpdater.exe, 00000006.00000003.700837705.0000000000E05000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.944944855.0000000006540000.00000004.00000001.sdmp	Binary or memory string: DevBusDesc=VMwaree=I;U
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware, Inc.VMW71.00V.13989454.B64.190619053806/19/2019
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.944034143.0000000005A4C000.00000004.00000001.sdmp	Binary or memory string: !tVMware
Source: PCHelpSoftDriverUpdater.exe	Binary or memory string: VMware VMCI Host Device
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945147685.0000000006583000.00000004.00000001.sdmp	Binary or memory string: DeviceDescRaw=Microsoft Hyper-V Generation Counter
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945534071.000000000659E000.00000004.00000001.sdmp	Binary or memory string: DevBusDesc=VMware Virtual USB Mouse
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware7,1
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945534071.000000000659E000.00000004.00000001.sdmp	Binary or memory string: 2DeviceDescRaw=Microsoft Hyper-V Generation Counter
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733557464.000000000549F000.00000004.00000001.sdmp	Binary or memory string: Mware, Inc.NoneVMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a edVMware7,1
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWhOD
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.944034143.0000000005A4C000.00000004.00000001.sdmp	Binary or memory string: 6190538\|VMware, Inc.\|VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945147685.0000000006583000.00000004.00000001.sdmp	Binary or memory string: DevDriverDesc=Microsoft Hyper-V Generation Counter
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945719904.0000000006630000.00000004.00000001.sdmp	Binary or memory string: vmware`
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000003.733658703.000000000549B000.00000004.00000001.sdmp	Binary or memory string: VMware Virtual RAM
Source: Driver_Updater.exe, 00000004.00000002.724163867.0000000002510000.00000002.00000001.sdmp, Driver_Updater.tmp, 00000005.00000002.719342677.00000000027D0000.00000002.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934780220.0000000003230000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945534071.000000000659E000.00000004.00000001.sdmp	Binary or memory string: DevBusDesc=VMwarel7
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945719904.0000000006630000.00000004.00000001.sdmp	Binary or memory string: $Microsoft Hyper-V Generation Counter625"
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945147685.0000000006583000.00000004.00000001.sdmp	Binary or memory string: RegDriverDesc=Microsoft Hyper-V Generation Counter
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.945147685.0000000006583000.00000004.00000001.sdmp	Binary or memory string: DevBusDesc=VMware
Source: Driver_Updater.exe, 00000004.00000002.724163867.0000000002510000.00000002.00000001.sdmp, Driver_Updater.tmp, 00000005.00000002.719342677.00000000027D0000.00000002.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934780220.0000000003230000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Code function: 5_2_0062FC50 ShellExecuteExW,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

5_2_0062FC50

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Schedule' /F	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Monitoring' /F	Jump to behavior
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Process created: C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe 'C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe'	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Code function: 5_2_005A522C InitializeSecurityDescriptor,SetSecurityDescriptorDacl,

5_2_005A522C

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Code function: 5_2_005A43D0 AllocateAndInitializeSid,GetVersion,GetModuleHandleW,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

5_2_005A43D0

Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.933222054.0000000001510000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.933222054.0000000001510000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Driver_Updater.tmp, 00000005.00000003.711464692.0000000005421000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.933222054.0000000001510000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: PCHelpSoftDriverUpdater.exe, 00000009.00000002.933222054.0000000001510000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\download\Driver_Updater.exe

Code function: 4_2_00405AC0 cpuid

4_2_00405AC0

Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	4_2_0040B3B8
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: GetLocaleInfoW,	4_2_0041E154
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: GetLocaleInfoW,	4_2_0041E1A0
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_0040A840
Source: C:\Users\user\Desktop\download\Driver_Updater.exe	Code function: GetLocaleInfoW,	4_2_004A0F30
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	5_2_0040CD4C
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: GetLocaleInfoW,	5_2_005EE07C
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_0040C1D4
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	6_2_0040D970
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: GetLocaleInfoW,	6_2_00426764
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: GetLocaleInfoW,	6_2_004267B0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_0040CE10
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	9_2_0040D970
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: GetLocaleInfoW,	9_2_00426764
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: GetLocaleInfoW,	9_2_004267B0
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_0040CE10

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 9_2_0075A27C SetupDiGetDeviceRegistryPropertyW,GetLastError,GetLastError,

9_2_0075A27C

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe	Queries volume information: C:\Users\user\Desktop\download VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp

Code function: 5_2_0060D02C GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeW,GetLastError,CreateFileW,SetNamedPipeHandleState,CreateProcessW,CloseHandle,CloseHandle,

5_2_0060D02C

Source: C:\Users\user\Desktop\download\Driver_Updater.exe

Code function: 4_2_0041C4F8 GetLocalTime,

4_2_0041C4F8

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 6_2_00975998 GetUserNameW,

6_2_00975998

Source: C:\Users\user\Desktop\download\Driver_Updater.exe

Code function: 4_2_004A7114 GetModuleHandleW,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy,

4_2_004A7114

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: SmtpPassword	6_2_006E7360
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: SmtpPassword	6_2_006E7360
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: SmtpPassword	9_2_006E7360
Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe	Code function: SmtpPassword	9_2_006E7360

Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Code function: 9_2_007982D8 CreateBindCtx,MkParseDisplayName,

9_2_007982D8

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	LSASS Driver1	Exploitation for Privilege Escalation1	Deobfuscate/Decode Files or Information1	Credentials in Registry1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Native API3	Scheduled Task/Job1	LSASS Driver1	Obfuscated Files or Information2	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter2	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Masquerading12	Security Account Manager	File and Directory Discovery4	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Scheduled Task/Job1	Logon Script (Mac)	Process Injection13	Virtualization/Sandbox Evasion3	NTDS	System Information Discovery166	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Scheduled Task/Job1	Access Token Manipulation1	LSA Secrets	Query Registry2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Registry Run Keys / Startup Folder1	Process Injection13	Cached Domain Credentials	Security Software Discovery221	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Virtualization/Sandbox Evasion3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Process Discovery3	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Application Window Discovery11	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Owner/User Discovery3	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe	3%	Virustotal		Browse
https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-0IPJB.tmp	3%	Metadefender		Browse
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-0IPJB.tmp	18%	ReversingLabs	Win32.PUA.Avanquest
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp	3%	Metadefender		Browse
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp	18%	ReversingLabs	Win32.PUA.Avanquest
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-5TGG4.tmp	0%	Metadefender		Browse
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-5TGG4.tmp	7%	ReversingLabs
C:\Program Files (x86)\PC HelpSoft Driver Updater\is-ISR8J.tmp	4%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://receiver.smartpcupdate.com/1	0%	Avira URL Cloud	safe
https://www.pchelpsoft.compf	0%	Avira URL Cloud	safe
https://www.pchelpsoft.com&dcid=216151425&purl=1&mkey1=DT_TRACK_ALL&tracking=DT_TRACK_ALL&mkey10=DT_	0%	Avira URL Cloud	safe
https://receiver.smartpc94~	0%	Avira URL Cloud	safe
https://stats.avqtools.com	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64tG	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_642	0%	Avira URL Cloud	safe
https://techsupport.smartpcupdate.com/	0%	Avira URL Cloud	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
https://techsupport.smartpcupdate.com/tracker/click/PCDU_54578/1/Install	0%	Avira URL Cloud	safe
http://crl.sca1b.amazontrust.com/sca1b.crlxe	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/	0%	Avira URL Cloud	safe
http://crt.user	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/10_64.jsonx	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/api/	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/10_64.jsonm	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
https://cdn.pchelpsoft	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://receiver.smartpc	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64	0%	Avira URL Cloud	safe
https://notifications.avqtools.comy8	0%	Avira URL Cloud	safe
https://updates.avqtools.com	0%	Avira URL Cloud	safe
http://www.dk-soft.org/	0%	URL Reputation	safe
http://www.dk-soft.org/	0%	URL Reputation	safe
http://www.dk-soft.org/	0%	URL Reputation	safe
http://ocsp.sectigo.com0K	0%	Avira URL Cloud	safe
https://subscriptions.avqtools.com03	0%	Avira URL Cloud	safe
http://crl.sca1b.amazontrust.com/sca1b.crl	0%	URL Reputation	safe
http://crl.sca1b.amazontrust.com/sca1b.crl	0%	URL Reputation	safe
http://crl.sca1b.amazontrust.com/sca1b.crl	0%	URL Reputation	safe
https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64x	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64B	0%	Avira URL Cloud	safe
https://receiver.smartpcupdate.com/10_64.7z?partner=PCHelpSoftDriverUpdater&version=5.4.549&nocache=	0%	Avira URL Cloud	safe
https://subscriptions.avqtools.com	0%	Avira URL Cloud	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64tual	0%	Avira URL Cloud	safe
https://stats.avqtools.compf	0%	Avira URL Cloud	safe
https://notifications.avqtools.com03	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0E	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
webtools.pchelpsoft.com	217.195.25.242	true	false	high
pchelpsoft.com	34.202.46.34	true	false	high
receiver.smartpcupdate.com	94.130.13.99	true	false	unknown
d2tfm4s145tlst.cloudfront.net	13.225.74.90	true	false	high
webtools.avanquest.com	217.195.25.241	true	false	high
techsupport.smartpcupdate.com	176.9.52.221	true	false	unknown
www.pchelpsoft.com	unknown	unknown	false	high
cdn.pchelpsoft.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://webtools.pchelpsoft.com/install_success.cfm?redirectId=pchelpsoft/driver_updater_tracked.htm&target=https://www.pchelpsoft.com&dcid=216151425&purl=1&mkey1=DT_TRACK_ALL&tracking=DT_TRACK_ALL&mkey10=DT_TRACK_ALL	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://receiver.smartpcupdate.com/1	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943402184.0000000005438000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_update_param.htm	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://www.pchelpsoft.compf	PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pchelpsoft.com&dcid=216151425&purl=1&mkey1=DT_TRACK_ALL&tracking=DT_TRACK_ALL&mkey10=DT_	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943391760.0000000005430000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://www.pchelpsoft.com/de/company/eula/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	Driver_Updater.exe, 00000004.00000000.666488768.0000000000401000.00000020.00020000.sdmp	false		high
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-renew.htm	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934050390.0000000002AA4000.00000004.00000001.sdmp	false		high
https://www.pchelpsoft.com/wp-json/wp/v2/pages/2	PCHelpSoftDriverUpdater.exe, 00000009.00000003.731333460.0000000005478000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	PCHelpSoftDriverUpdater.exe	false		high
https://receiver.smartpc94~	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943510156.000000000546C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://stats.avqtools.com	PCHelpSoftDriverUpdater.exe, 00000006.00000003.700741717.0000000002A36000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-uninstall.htm	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64tG	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943510156.000000000546C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://webtools.avanquest.com/5	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	false		high
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-home.htm	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://www.pchelpsoft.com/S	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp	false		high
https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_642	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943594176.00000000054A3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://techsupport.smartpcupdate.com/	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pchelpsoft.com/company/privacy-policy/U	PCHelpSoftDriverUpdater.exe, 00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
http://www.indyproject.org/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://webtools.pchelpsoft.com/install_success.cfm?redirectId=pchelpsoft/driver_updater_tracked.htm&	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.943435773.0000000005443000.00000004.00000001.sdmp	false		high
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-support.htm	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://techsupport.smartpcupdate.com/tracker/click/PCDU_54578/1/Install	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/pcc-cs-download.htm	PCHelpSoftDriverUpdater.exe	false		high
http://crl.sca1b.amazontrust.com/sca1b.crlxe	wget.exe, 00000003.00000002.658944123.0000000001446000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
https://receiver.smartpcupdate.com/	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943402184.0000000005438000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pchelpsoft.com/wp-json/	PCHelpSoftDriverUpdater.exe, 00000009.00000003.731333460.0000000005478000.00000004.00000001.sdmp	false		high
https://www.pchelpsoft.com/product/pc-cleaner/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
http://crt.user	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932113971.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe	wget.exe, 00000003.00000002.658944123.0000000001446000.00000004.00000040.sdmp	false		high
https://www.pchelpsoft.com/	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943460253.0000000005450000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000003.731333460.0000000005478000.00000004.00000001.sdmp	false		high
https://receiver.smartpcupdate.com/10_64.jsonx	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943594176.00000000054A3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pchelpsoft.com/?mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALLI	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943402184.0000000005438000.00000004.00000001.sdmp	false		high
https://www.pchelpsoft.com/?mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALLcesM	PCHelpSoftDriverUpdater.exe, 00000009.00000002.934050390.0000000002AA4000.00000004.00000001.sdmp	false		high
https://www.pchelpsoft.com/es/company/eula/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-home.htmA/	Driver_Updater.tmp, 00000005.00000003.714304118.00000000025B2000.00000004.00000001.sdmp	false		high
https://receiver.smartpcupdate.com/api/	PCHelpSoftDriverUpdater.exe, 00000006.00000003.700749769.0000000002A3D000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pchelpsoft.com/de/company/privacy-policy/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
http://www.sqlite.org/copyright.html.	Driver_Updater.tmp, 00000005.00000003.710652840.0000000005077000.00000004.00000001.sdmp	false		high
https://receiver.smartpcupdate.com/10_64.jsonm	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	Driver_Updater.exe, 00000004.00000003.667294481.0000000002740000.00000004.00000001.sdmp, Driver_Updater.tmp, Driver_Updater.tmp, 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.pchelpsoft.com/company/eula/U	PCHelpSoftDriverUpdater.exe, 00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cdn.pchelpsoft	wget.exe, 00000003.00000002.658830174.0000000000BC0000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pchelpsoft.com	Driver_Updater.tmp, 00000005.00000002.715452724.000000000018C000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000006.00000003.700611451.00000000029A4000.00000004.00000001.sdmp	false		high
https://sectigo.com/CPS0	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.pchelpsoft.com/company/eula/Q	Driver_Updater.tmp, 00000005.00000003.714513888.000000000260A000.00000004.00000001.sdmp	false		high
https://receiver.smartpc	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943510156.000000000546C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/pcc-cs-download.htmU	Driver_Updater.tmp, 00000005.00000003.711464692.0000000005421000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943510156.000000000546C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pchelpsoft.com/fr/company/privacy-policy/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
http://www.pchelpsoft.com/images/build-phone-banners/phone_activation.png1	PCHelpSoftDriverUpdater.exe, 00000006.00000003.700689552.00000000029FC000.00000004.00000001.sdmp	false		high
https://webtools.avanquest.com/	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	false		high
http://www.7-zip.org	Driver_Updater.exe, 00000004.00000003.666874452.0000000002600000.00000004.00000001.sdmp, Driver_Updater.tmp, 00000005.00000003.714087786.00000000037CE000.00000004.00000001.sdmp	false		high
https://api.w.org/	PCHelpSoftDriverUpdater.exe, 00000009.00000003.731333460.0000000005478000.00000004.00000001.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	Driver_Updater.exe	false		high
https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_update_param.htmqB	PCHelpSoftDriverUpdater.exe, 00000006.00000003.700637042.00000000029C1000.00000004.00000001.sdmp	false		high
https://www.pchelpsoft.com/es/company/privacy-policy/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://notifications.avqtools.comy8	PCHelpSoftDriverUpdater.exe, 00000006.00000003.700773560.0000000002A53000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.	wget.exe, 00000003.00000002.658939024.0000000001440000.00000004.00000040.sdmp	false		high
https://www.pchelpsoft.com/company/privacy-policy/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
http://www.pchelpsoft.com/images/build-phone-banners/phone_activation.pngA	PCHelpSoftDriverUpdater.exe, 00000006.00000003.700689552.00000000029FC000.00000004.00000001.sdmp	false		high
https://updates.avqtools.com	PCHelpSoftDriverUpdater.exe, 00000006.00000003.700766150.0000000002A4C000.00000004.00000001.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pchelpsoft.com/fr/company/eula/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
http://www.dk-soft.org/	Driver_Updater.exe, 00000004.00000003.666874452.0000000002600000.00000004.00000001.sdmp, Driver_Updater.tmp, 00000005.00000003.670609142.0000000003490000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.pchelpsoft.com	PCHelpSoftDriverUpdater.exe	false		high
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver-updater-5-upsell.htm	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp, PCHelpSoftDriverUpdater.exe, 00000009.00000002.934050390.0000000002AA4000.00000004.00000001.sdmp	false		high
http://ocsp.sectigo.com0K	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943548638.0000000005481000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pchelpsoft.com/images/build-phone-banners/phone_activation.png	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://subscriptions.avqtools.com03	PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sca1b.amazontrust.com/sca1b.crl	wget.exe, 00000003.00000002.658944123.0000000001446000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_postinstall.htm	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64x	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943594176.00000000054A3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64B	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943594176.00000000054A3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://receiver.smartpcupdate.com/10_64.7z?partner=PCHelpSoftDriverUpdater&version=5.4.549&nocache=	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932355059.0000000000EED000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://subscriptions.avqtools.com	PCHelpSoftDriverUpdater.exe, 00000006.00000003.700773560.0000000002A53000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	Driver_Updater.exe, 00000004.00000003.667294481.0000000002740000.00000004.00000001.sdmp, Driver_Updater.tmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.pchelpsoft.com/company/privacy-policy/3	Driver_Updater.tmp, 00000005.00000003.713688074.00000000036C8000.00000004.00000001.sdmp	false		high
https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64tual	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932113971.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://stats.avqtools.compf	PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pchelpsoft.com/?mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALL	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943402184.0000000005438000.00000004.00000001.sdmp	false		high
https://www.pchelpsoft.com/company/eula/	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://webtools.avanquest.com/redirect.cfm?eredirectId=pchelpsoft/driver_updater_buy.htm	PCHelpSoftDriverUpdater.exe, PCHelpSoftDriverUpdater.exe, 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp	false		high
https://notifications.avqtools.com03	PCHelpSoftDriverUpdater.exe, 00000009.00000002.934068675.0000000002AAB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_postinstall.htmE	PCHelpSoftDriverUpdater.exe, 00000009.00000002.932113971.0000000000E9A000.00000004.00000020.sdmp	false		high
http://ocsp.sectigo.com0E	PCHelpSoftDriverUpdater.exe, 00000009.00000002.943639341.00000000054B9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://webtools.avanquest.com/redirect.cfm?redirectId=pchelpsoft/driver_updater_update_param.htmp	PCHelpSoftDriverUpdater.exe, 00000009.00000002.933947398.0000000002A61000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
13.225.74.90	d2tfm4s145tlst.cloudfront.net	United States	16509	AMAZON-02US	false
176.9.52.221	techsupport.smartpcupdate.com	Germany	24940	HETZNER-ASDE	false
94.130.13.99	receiver.smartpcupdate.com	Germany	24940	HETZNER-ASDE	false
217.195.25.241	webtools.avanquest.com	France	34006	VEEPEE-ASNFR	false
34.202.46.34	pchelpsoft.com	United States	14618	AMAZON-AESUS	false
217.195.25.242	webtools.pchelpsoft.com	France	34006	VEEPEE-ASNFR	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	450578
Start date:	19.07.2021
Start time:	11:49:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.spyw.evad.win@20/76@9/6
EGA Information:	Successful, ratio: 60%
HDC Information:	Successful, ratio: 16.9% (good quality ratio 16.5%) Quality average: 76.7% Quality standard deviation: 23.1%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 104.43.139.144, 52.147.198.201, 40.88.32.150, 204.79.197.222, 20.82.210.154, 20.54.110.249, 173.222.108.226, 173.222.108.210, 52.113.196.254, 40.112.88.60, 80.67.82.235, 80.67.82.211, 20.50.102.62 Excluded domains from analysis (whitelisted): fp.msedge.net, au.download.windowsupdate.com.edgesuite.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, a-0019.a-msedge.net, skypedataprdcoleus15.cloudapp.net, teams-9999.teams-msedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, a-0019.standard.a-msedge.net, audownload.windowsupdate.nsatc.net, 1.perf.msedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, teams-ring.teams-9999.teams-msedge.net, teams-ring.msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Execution Graph export aborted for target wget.exe, PID 6988 because there are no executed function Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:50:24	Task Scheduler	Run new task: PC HelpSoft Driver Updater automatic scan and new device notifications path: "C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe"
11:50:26	API Interceptor	1x Sleep call for process: HDMTray.exe modified
11:50:26	API Interceptor	1x Sleep call for process: PCHelpSoftDriverUpdater.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\PC HelpSoft Driver Updater\HomePage.url Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.pchelpsoft.com>), UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	155
Entropy (8bit):	5.182707750158328
Encrypted:	false
SSDEEP:	3:o6ABGQYm/0S4f0mnKd4ovst1Jj4I51mFtP8FFFwVy1P8hcTyjFv:o6FVm/r44dlvstf5ktEF4VG8higFv
MD5:	17FFA13120F9FC84D41C3CD6AB7BEAD9
SHA1:	CC1C240A9C79C64049686FC801494FE5B2341EE4
SHA-256:	D3EE2624B681B2849A92225AD15758E4644FDE6E2AC83A75B0067F861A2FAFBD
SHA-512:	F3124B410F0068D872995B7733138854AFE64DBD902CCB702DBD97F5814C281C24E56BF3BA995BCBADFE09D2F9059B7B970F6083D2346A674C65FD6D457B50E9
Malicious:	false
Reputation:	low
Preview:	.[InternetShortcut]..URL=http://www.pchelpsoft.com..IconIndex=0..IconFile=C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe..

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-05T81.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	43512
Entropy (8bit):	4.840218199038898
Encrypted:	false
SSDEEP:	768:WNUQghjwZdVKJNmy4eEOqnBwn127r8oN63jX+9foWju:WSns7a6XOaBwnWR9fE
MD5:	5C54A9C65EDEAB35101A0DDADA1BEC91
SHA1:	2D5C2DA06B21399DE87062CB6873B152023B46BE
SHA-256:	69E8806025FAC69AA03BB9C98BBB965E77C8562581F0BF5053EB7ED611DCC1C7
SHA-512:	605FE61540EE103DFF7C8D4D38D723C8173C7B1E9EB17A2F8D9CCB789D9BCA7A463A5A820E9610DF3A319DD489909FF6EB7AAC033F4437F5E1AE8DF34431D1AC
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimizar..Close=Fechar..Open=Abrir..Help=Ajuda..Start=Iniciar..StartScan=Iniciar an.lise..Cancel=Cancelar..Stop=Parar..Next=Seguinte..Details=Detalhes..CheckAll=Marcar todos..UncheckAll=Desmarcar todos..Apply=Aplicar..Yes=Sim..No=N.o..OK=OK..Information=Informa..o..Confirmation=Confirma..o..Question=Tem a certeza que pretende parar esta an.lise?..Attention=Aten..o..RemoveItems=Remover itens..Refresh=Atualizar..Search=Pesquisa..Remove=Remover..Delete=Eliminar..Save=Guardar..UninstallAndRestart=Desinstalar e reiniciar..KeepLimited=Continuar com a vers.o limitada..LearnMore=Saber mais..Continue=Continuar..OpenProgram=Abrir o %s..RunProgram=Iniciar o %s..Update=Atualizar..FixAll=Corrigir tudo..Reboot=Reiniciar..OkThanks=OK, obrigado..NoThanks=N.o, obrigado..ScanAgain=Analisar novamente....[Actions]..Actions=Ac..es..Scan=Analisar..Backup=C.pia de seguran.a..BackupDrivers=C.pia de seguran.a..DownloadHistory=Hist.rico..Settings=Configura..es..Toolbo

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-090DD.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	40940
Entropy (8bit):	4.81933806376472
Encrypted:	false
SSDEEP:	384:gH0OEyL9/uQYhfVAlF/1w+k+FewmbJPt3RdnkuFVtbP/OFQUun1zJczMVMKoEMLv:7OrGdhfOlN1odRkuP5n1zJc4MBksp44
MD5:	275FB28015FD5BF549B2ACF3796433D4
SHA1:	EBDDFE257944C10652B762212822887786A2BFE2
SHA-256:	4FC6AA555D5B1F33B709813BFEF9FF3D9F766B4B24648E733062C1906D34224F
SHA-512:	B5E04A5C90DCDAEEE12885338E066819E764A443B703772F06F9FA9ECA3FB331F4865AFB5A0EE7F50CF48711F193111A9FC0AF42177E6A0311D009E092FF8C2B
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimaliseren..Close=Sluiten..Open=Open..Help=Help..Start=Start..StartScan=Start Scan..Cancel=Annuleren..Stop=Stop..Next=Volgende..Details=Details..CheckAll=Alles inschakelen..UncheckAll=Alles uitschakelen..Apply=Pas toe..Yes=Ja..No=Nee..OK=OK..Information=Informatie..Confirmation=Bevestiging..Question=Weet je zeker dat je deze scan wilt stoppen?..Attention=Pas Op..RemoveItems=Items verwijderen..Refresh=Vernieuwen..Search=Zoeken..Remove=Verwijderen..Delete=Verwijderen..Save=Opslaan..UninstallAndRestart=Verwijderen en opnieuw starten..KeepLimited=Doorgaan met de beperkte versie..LearnMore=Meer informatie..Continue=Doorgaan..OpenProgram=%s openen..RunProgram=%s uitvoeren..Update=Bijwerken..FixAll=Alles oplossen..Reboot=Opnieuw opstarten..OkThanks=OK, bedankt..NoThanks=Nee, bedankt..ScanAgain=Opnieuw scannen....[Actions]..Actions=Acties..Scan=Scan..Backup=Backup..BackupDrivers=Backup..DownloadHistory=Geschiedenis..Settings=Instellingen..Toolbox=Toolbox....[Messages]

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-0IPJB.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7873880
Entropy (8bit):	6.4714153680685635
Encrypted:	false
SSDEEP:	98304:HK1hprsPvZ4iYhx7CMZsfnuWeoOQu1IE83+H:Hahp+v3Yf7uuWez/83Y
MD5:	BDB2972360FC3DC01C7A39BDEE2B4DED
SHA1:	3CD79DF902BACD4DB4ED6A7145E2C8BD168B940C
SHA-256:	965BF402594EE539CE61D2A593C421B1C7ED6E1969369AE4A7866C17B2281A3C
SHA-512:	89A992FD2AB89DEA3144106C13AB1FFD5514D0142F86F54FCA8A74FB881E6EDB8FF52E612CCBD6A42D0CBDCFC4A7F12EDAFA76E684593A85133F9285A9AA93AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-0IPJB.tmp, Author: Joe Security
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 18%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......`..................Z..^......T.Z.......Z...@...........................x.......x...@......@...................0^.......]..]...`^...............w.X'...................................P^.......................].......^......................text...d8Z......:Z................. ..`.itext...`...PZ..b...>Z............. ..`.data....\....Z..^....Z.............@....bss......... ]..........................idata...]....]..^....\.............@....didata.......^......\].............@....edata.......0^......n].............@..@.tls....L....@^..........................rdata..]....P^......p].............@..@.rsrc........`^......r].............@..@..............x.......w.............@..@........................................................

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3995480
Entropy (8bit):	6.587998478228155
Encrypted:	false
SSDEEP:	49152:oPzVKarN1ASssWlpzqx2LR5nEzGqdo5Oc/Au5CWDbxPS5pTQ4JJc9r:oPhKarU5nSGqq5Oxu5LDbx65VJJk
MD5:	E60CDC64F61639E9D35F3315440F16F6
SHA1:	10451B4225675B2839D42484301C54697A8DAB8F
SHA-256:	976818892D5B8612AE9CB45BC088A6789685DC92D89FCAB1EC49366B81A5736E
SHA-512:	03A7FB248C65B5FD2C07165C7CAE828552A11DAF19911F5786DD8CA45F4CE9CD4C2B6F4A7A0B861169ED2565F09B58161F39023BCB05B7F1F261DBE6C9B6D3A0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-1I08D.tmp, Author: Joe Security
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 18%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......`..................2.........8.2.......2...@...........................=.......=..........@....................6.......5..J....:...............<.X'...06..q........................... 6.......................5.......5."....................text... .2.......2................. ..`.itext..TB....2..D....2............. ..`.data...4&....2..(....2.............@....bss.....v... 5..........................idata...J....5..L....4.............@....didata.".....5......@5.............@....edata........6......N5.............@..@.tls....D.....6..........................rdata..].... 6......P5.............@..@.reloc...q...06..r...R5.............@..B.rsrc.........:.......9.............@..@..............=.......<.............@..@................

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-3H3VF.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	45432
Entropy (8bit):	4.76518531279938
Encrypted:	false
SSDEEP:	768:Y1+PmC6AN4NRXX0azNitUUYMqqs4xG/3YzMNo729sL1UN:Y1+uUN4NxkazNi3KaxGfYzMN8VU
MD5:	6C4858517BEC6C9DBE35E6EDF2645161
SHA1:	32CFC6096F9A95F41C461CC1600B83463E54D495
SHA-256:	E0D8C6C37F2501472DEC44337A6A2030E63207807A7EBF076F0068093C8288D4
SHA-512:	410480361EB1ED2A0B06296F6B10BECFFC03AD9881BDC154A60D483F4BC97AB7117C5F58C48AA23B574398489DB6900D63F9A8EEA87F65A50751BB00CD6D361C
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Riduci a icona..Close=Chiudi..Open=Apri..Help=Guida..Start=Avvia..StartScan=Avvia scansione..Cancel=Annulla..Stop=Interrompi..Next=Avanti..Details=Dettagli..CheckAll=Seleziona tutto..UncheckAll=Deseleziona tutto..Apply=Applica..Yes=S...No=No..OK=OK..Information=Informazioni..Confirmation=Conferma..Question=Interrompere la scansione?..Attention=Attenzione..RemoveItems=Rimuovi voci..Refresh=Aggiorna..Search=Trova..Remove=Rimuovi..Delete=Elimina..Save=Salva..UninstallAndRestart=Disinstallazione e riavvio..KeepLimited=Continua con la versione limitata..LearnMore=Maggiori informazioni..Continue=Continua..OpenProgram=Apri %s..RunProgram=Avvia %s..Update=Aggiorna..FixAll=Ripara tutti..Reboot=Riavvia..OkThanks=OK, grazie..NoThanks=No grazie..ScanAgain=Esegui di nuovo la scansione....[Actions]..Actions=Azioni..Scan=Scansione..Backup=Backup..BackupDrivers=Backup..DownloadHistory=Cronologia..Settings=Impostazioni..Toolbox=Casella strumenti....[Messages]..Stop=Annullare l'o

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-4R3H1.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	63852
Entropy (8bit):	4.7744398416738205
Encrypted:	false
SSDEEP:	1536:SQi2uG8bBpQlpA4AG70saiZwIX0edtA1aOJq0RJN5xhGh3yi:SQivBpQl3QziZwIXzQ4OJq0RJNsii
MD5:	0EF73EE2C9DA91806DD9BEDD105B6E98
SHA1:	0FF9842E3C3007341E4F76C5DB62E7986A3B8E2E
SHA-256:	F453969988158D9C991D8026A1DCFA4658D140898A79610A03E521379EE25488
SHA-512:	D96662403EB1537712D7BA0A428890A8058E05EF62F75DE4111E2D9608EE9172E98D00AD3732567B860E07838EB08A700EC2E4DA67E1C57AFA548B112F05D294
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=..........Close=.........Open=.........Help=........Start=........StartScan=...... ..............Cancel=..........Stop=............Next=........Details=..........CheckAll=....... .....UncheckAll=........ ..... ... ......Apply=...........Yes=....No=.....OK=OK..Information=............Confirmation=...............Question=.. ......., ... ...... .......... ... ............?..Attention=..........RemoveItems=....... ..........Refresh=..........Search=.......Remove=.........Delete=.........Save=...........UninstallAndRestart=....... . ...............KeepLimited=.......... . ............ .........LearnMore=...... ........Continue=............OpenProgr

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-5GD5L.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	SQLite 3.x database, last written using SQLite version 0
Category:	dropped
Size (bytes):	1093632
Entropy (8bit):	6.129762807945235
Encrypted:	false
SSDEEP:	24576:sY8IyylDzjpmRFQn0gDcqhJWT2mZws7noPrbLD:rVlhyLa
MD5:	7B5CA14D6613ABE03EE21F5DEBF6AECA
SHA1:	2C1AC3194A2D5F9CC0A9FD0766FCCC07A95ADB31
SHA-256:	39CA88C94613EFA08238DD1E39F8ED2805524DA1DE4814D615DDFE192B5A65FB
SHA-512:	3DC33789050D957AE1FDDFB58CC1BD833451780E38F1532B821C3EB71152E9EE0CA45EBB570A899512E0F1981BD734E69E9E6C8170038BBC6625F73BC8A34B5D
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..................................................................................x..x...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................atablestartupstartup.CREATE TABLE startup (id integer PRIMARY KEY, file varchar(40), title varchar(40),

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-5QPF5.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16763
Entropy (8bit):	5.291091528132011
Encrypted:	false
SSDEEP:	192:NpHGgeq6JFKJouGz7FGYBIX4moaFMQweu++0EAbDCqaIiMpzvr1PjbncgG9/ZJf:Npmgeqz/fYB0zMQw0+0nWMpzTRnfG1Zh
MD5:	6996E9B91DDEF85CC63CDC39722893B7
SHA1:	C59417F6E31FF86E825573C0A1C32B75394A1DC0
SHA-256:	256E7B4A9E7392AE01911AC1B98C17E4B57260E2E29D5ECA4C756034915FB43C
SHA-512:	66D5C61A79FD9C6C70DFF21A9E15149E786747B0B7C6CF087F8EE173AEEF22E30785EA88A08C3C68CC4108232C11B5A54D707B13AE690C0BAD9972B76D290061
Malicious:	false
Reputation:	low
Preview:	ITSF....`..................\|.{.......".....\|.{......."..`...............x.......T.......................{A..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR......./#ITBITS..../#STRINGS...pF./#SYSTEM....../#TOPICS.....P./#URLSTR...x.x./#URLTBL...\.../#WINDOWS...y.L./$FIftiMain..../$OBJINST...M.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...I../$WWKeywordLinks/..../$WWKeywordLinks/Property...E../button.gif.....a./content.htm...'./index.htm..'.../page01.htm..@.L./page02.htm....../page03.htm....j./page04.htm..v.*./page05.htm.. .&./page07.htm..F.!./page08.htm..g.../page09.htm...k.../page10.htm...}.F./page11.htm...C.$./page12.htm...g.1.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....\,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-5TGG4.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	873192
Entropy (8bit):	6.543096836219819
Encrypted:	false
SSDEEP:	24576:dTtmtnhKqK75YJ4+X8NLXBIXcgVMU//GlM:dshc84y8NLXBUj/
MD5:	14E1F7EBCE8EED6A8D1F49BCA82115AE
SHA1:	76EB44368BB516C6A958ECAD2F6A44295C69E2BB
SHA-256:	AB8C0780873291E65723DB4ACD0EB58476781A842087EFEE8770F825906D1332
SHA-512:	5E3C918AEA61215482DC350D67CC5489417C223CE248C1F81AE71E8C5B6826FA249B37F0BC3C7D5B33FD3F24ADA8FCCD7BCB71430229A7E13984D12C9B36E38D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 7%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....4fZ.>.........!.........2.....................a.......................................... .........................[.... ..0....P...................;...`...0...........................@.......................!...............................text...............................`.P`.data...............................@.`..rdata..............................@.`@.bss..................................`..edata..[........ ..................@.0@.idata..0.... ......................@.0..CRT....,....0......................@.0..tls.... ....@......................@.0..rsrc........P......................@.0..reloc...0...`...2..................@.0B/4...................8..............@.@B/19.................<..............@..B/31..........P......................@..B/45..........p......................@..B/57.................................@.0B/70.....i...............

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-6EELS.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	40420
Entropy (8bit):	5.2005155825793885
Encrypted:	false
SSDEEP:	768:uKgdWS7vpSEurAkI49u8ZuOklB4BvzkHujS7gz5lt+hY2eEjKfnQS5jMUl44jcgw:tgT/BlmBQsCgbIpfJM7ZQDj
MD5:	59CFEFD0F4B62A86C042CC0FD8B8F7D5
SHA1:	CB5E8C45F8D0A0D01AA072E908090E4CEE83A09C
SHA-256:	209834A84082A775348D534CACDC67C2B11B325DB55DDB1478620DD30FDBD9E5
SHA-512:	D6D262C2970B07ACCC01E7CD4D03C4233F6384BBB2B0413C6AC6D07162F5B6A0B16D3B3B096B8D56828FB22D655A291532202B58C1E2B059FA67F169D3F121EC
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Zmniejsz..Close=Zamknij..Open=Otw.rz..Help=Pomoc..Start=Uruchom..StartScan=Uruchom skanowanie..Cancel=Anuluj..Stop=Zatrzymaj..Next=Nast.pny..Details=Szczeg..y..CheckAll=Zaznacz wszystkie..UncheckAll=Odznacz wszystkie..Apply=Zastosuj..Yes=Tak..No=Nie..OK=OK..Information=Informacje..Confirmation=Potwierdzenie..Question=Czy na pewno chcesz zatrzyma. skanowanie?..Attention=Uwaga..RemoveItems=Usu. elementy..Refresh=Od.wie...Search=Wyszukaj..Remove=Usu...Delete=Usu...Save=Zapisz..UninstallAndRestart=Odinstaluj i uruchom ponownie..KeepLimited=Kontynuuj z wersja ograniczona..OpenProgram=Otw.rz %s..RunProgram=Rozpocznij %s..Update=Aktualizuj..FixAll=Napraw wszystko..Reboot=Uruchom ponownie..OkThanks=Ok, dzi.kuj...NoThanks=Nie, dzi.kuj...ScanAgain=Zeskanuj ponownie....[Actions]..Actions=Dzia.ania..Scan=Skanuj..Backup=Backup..BackupDrivers=Backup..DownloadHistory=Historia pobierania..Settings=Ustawienia..Toolbox=Narz.dzia....[Messages]..Stop=Czy na pewno ch

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-6S1N1.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16505
Entropy (8bit):	5.237618512909826
Encrypted:	false
SSDEEP:	384:HaWeoff5fPZ+JcXrdV5d0I5MlAF4S/ra2:HaWeoffZPsJJI5lF4W5
MD5:	44533C85475C85AB3ECEE70ED0F24829
SHA1:	A05B376E58F018E7CA46D30D596132D2E45A7353
SHA-256:	E683864EAB9E98FA9B22A29228B607FA7C769588C482409FDC5FF66F7C5E073E
SHA-512:	B730A6549CBA83110671B07C6229143F49D671DB6BEB91F42C96690395EC95F51C4B2CADC815D85CEDED5E4B3CC3A53DF314C9809DE528F60CD03E52090F0AA6
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......O8.........\|.{.......".....\|.{......."..`...............x.......T.......................y@..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR......./#ITBITS..../#STRINGS...gF./#SYSTEM....../#TOPICS.....P./#URLSTR...o.x./#URLTBL...S.../#WINDOWS...p.L./$FIftiMain..../$OBJINST...D.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...@../$WWKeywordLinks/..../$WWKeywordLinks/Property...<../button.gif.....a./content.htm...+./index.htm..+.../page01.htm..-."./page02.htm..O.a./page03.htm..0.../page04.htm..N.W./page05.htm..%.#./page07.htm..H.C./page08.htm....P./page09.htm...[.../page10.htm..._.;./page11.htm.....%./page12.htm...?.P.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....Z,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-86P7T.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	18873
Entropy (8bit):	5.727880804484075
Encrypted:	false
SSDEEP:	384:nmo+3bgJYejE66Cg+TYYmXa7EdTEkAY9ztPlWtc:nl+LcYAE6ZTtD7CBAYroy
MD5:	59F78AEB5AB47FE9F33EBD44D4BEAE54
SHA1:	01F61A0B608A3858FBDA0D17D89973D8D5B42948
SHA-256:	78849B1B3C0030A5C0C53AA89D7EDB73418335049E4DCB3CA22A3D9B6091AAEB
SHA-512:	A41B30C110714936AB83FB2EA6AAC77E8EA77F8B51DCCDD3A35E2668C6FD2C41514EAB54D41B583226FAFD1F00717748A3AA963891B66690477A3C4283EEC3E1
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......o".........\|.{.......".....\|.{......."..`...............x.......T........................I..............ITSP....T...........................................j..].!......."..T...............PMGLG................/..../#IDXHDR...:.../#ITBITS..../#STRINGS....F./#SYSTEM....../#TOPICS...:.P./#URLSTR...&.x./#URLTBL......./#WINDOWS...'.L./$FIftiMain..../$OBJINST...{.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...w../$WWKeywordLinks/..../$WWKeywordLinks/Property...s../button.gif...F.a./content.htm...../index.htm....../page01.htm....../page02.htm..'.l./page03.htm....$./page04.htm..7.S./page05.htm.....Q./page07.htm...[.Z./page08.htm...5.../page09.htm...:.s./page10.htm...-.../page11.htm.....x./page12.htm...&. .::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content.....,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC2894

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-8AMUA.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	15957
Entropy (8bit):	5.154293969684413
Encrypted:	false
SSDEEP:	192:2rSkRQ91M2bM1QSy2nb4bbq5eKdfK5CX0NC1ZS636C:2zQ9jbcbGb2dfKMkNC1x6C
MD5:	59B524D981591D1AAB9AAF4C893379B7
SHA1:	2928DE04D3A6B5904705D7EC2DC94AFC2A4DEB0F
SHA-256:	DC9BDCE71C75DD3E0D448451B3C9D6BD580FFE7AD38A1A78C58980612624F169
SHA-512:	BEB0AE8C80082A06606E7515B21E69B8CD32032E8FC62BDCDAF9B823BC5ABBF77E9FF5B0751373791C95FDB5D12B3E87DFF209C81FC88ECDD4CF19DDA7E05E67
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......2.........\|.{.......".....\|.{......."..`...............x.......T.......................U>..............ITSP....T...........................................j..].!......."..T...............PMGL\................/..../#IDXHDR......./#ITBITS..../#STRINGS...LF./#SYSTEM....../#TOPICS.....@./#URLSTR...g.e./#URLTBL...W.../#WINDOWS.....L./$FIftiMain..../$OBJINST...X.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...T../$WWKeywordLinks/..../$WWKeywordLinks/Property...P../button.gif...#.a./content.htm...l./index.htm..l.../page01.htm..p.8./page02.htm..(.A./page03.htm..i.Q./page04.htm..:.f./page05.htm.. .g./page07.htm....../page08.htm....2./page09.htm...@.../page10.htm...K.../page12.htm...`.C.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....>,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D31-11D0-9B27-00A0

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-8J9LQ.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	42276
Entropy (8bit):	4.853717784128648
Encrypted:	false
SSDEEP:	768:qTOu06N44ZUPppAPKgRK1DzpYiJ3vQoHhY7d7D4f3:qTOz6N44ZUP0SnNppvQoH6ZgP
MD5:	7052EA04D8EDB0CFE6BE68FE9D2BEBC6
SHA1:	153B021F81BB40ED08B88B02D2EE88EECFFF67D4
SHA-256:	6141FAFDF0407CB7C798D54AD84405CE588F1D001A55C43502A766A7BD92DB51
SHA-512:	7B05A49CAFB8D03618A7C289065A87A9B88C1BC6049835310CA042CEBF187DCF6B75B82CD8A0DFF094749382D7216905BFDEEF5699ACF4C9AFCC713DEAE3F9D6
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimize..Close=Close..Open=Open..Help=Help..Start=Start..StartScan=Start Scan..Cancel=Cancel..Stop=Stop..Next=Next..Details=Details..CheckAll=Check all..UncheckAll=Uncheck all..Apply=Apply..Yes=Yes..No=No..OK=OK..Information=Information..Confirmation=Confirmation..Question=Are you sure you wish to stop this scan?..Attention=Attention..RemoveItems=Remove items..Refresh=Refresh..Search=Search..Remove=Remove..Delete=Delete..Save=Save..UninstallAndRestart=Uninstall and restart..KeepLimited=Continue with limited version..LearnMore=Learn more..Continue=Continue..OpenProgram=Open %s..RunProgram=Run %s..Update=Update..FixAll=Fix All..Reboot=Reboot..OkThanks=OK, thanks..NoThanks=No, thanks..ScanAgain=Scan again....[Actions]..Actions=Actions..Scan=Scan..Backup=Backup..BackupDrivers=Backup..DownloadHistory=History..Settings=Settings..Toolbox=Toolbox....[Messages]..Stop=Are you sure you wish to cancel this operation?..AdminRights=You must have administrative privileges to i

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-BUH0L.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	38880
Entropy (8bit):	4.872954178244705
Encrypted:	false
SSDEEP:	768:plORkvnHALlkv3YnOCG9Vx5P9oOHb7jAdbGyB10TXFY/hd9Bhdh2SeoDKzxP:77p3B+W7a6cdpL2S5DC
MD5:	73304C95897DC1353D38E684CBC08637
SHA1:	0002AD497369BDF224503FC26A8B3795F4E552EF
SHA-256:	5C065AD26D5030CFD71B7E529196DCF280CFCA46E7DCA59AC7A6E377A39E209F
SHA-512:	A060EFBA8EA9CE9ABD54EC602DB8E2896C07FA2715FC7C8A39C0B20FDDDAA62F7FF7093F16030D99E370283B0D3E06FE17750E119818A22E2145825860BED90C
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimer..Close=Lukk..Open=.pne..Help=Hjelp..Start=Start..StartScan=Start skanning..Cancel=Avbryt..Stop=Stopp..Next=Neste..Details=Detaljer..CheckAll=Merk av alle..UncheckAll=Fjern avmerking alle..Apply=Bruk..Yes=Ja..No=Nei..OK=OK..Information=Opplysninger..Confirmation=Bekreftelse..Question=Er du sikker p. at du vil stoppe denne skanningen?..Attention=Advarsel..RemoveItems=Fjern elementer..Refresh=Oppdater..Search=S.k..Remove=Fjern..Delete=Slett..Save=Lagre..UninstallAndRestart=Avinstaller og start p. nytt..KeepLimited=Fortsett med den begrensede versjonen..LearnMore=Finn ut mer..Continue=Fortsett..OpenProgram=.pne %s..RunProgram=Start %s..Update=Oppdater..FixAll=Fiks alle..Reboot=Start p. nytt..OkThanks=OK, takk..NoThanks=Nei takk..ScanAgain=Skann p. nytt....[Actions]..Actions=Handlinger..Scan=Skanne..Backup=Sikkerhetskopi..BackupDrivers=Sikkerhetskopi..DownloadHistory=Nedlastinger..Settings=Innstillinger..Toolbox=Verkt.ykasse....[Messages]..Stop=Er du s

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-C668L.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16695
Entropy (8bit):	5.281652678414032
Encrypted:	false
SSDEEP:	192:utTl/EDVbvlLnPl/IXVpOWx1pFCzj/GVYEQU4Yve:utJ/ED1vlbl/urvvC2VYEQFOe
MD5:	7DEA81C576B48133AA9D4B249B37F37F
SHA1:	918AF4A3668A2D4F009DE521543FCEB83E5800BC
SHA-256:	A05BE6813945C6C61ACF2C32D473E10A1D1BEE15E71E31706A7D9C61A5754C4B
SHA-512:	5F06C5085F5C7902FC7B9984342D054F39F30B33D8C6C9CE5221BC62309DDA95E4F77367C17BE10C4E2564E06BE5F9E942D187B7A44CF4A549543A65969F0A30
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......K..........\|.{.......".....\|.{......."..`...............x.......T.......................7A..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR...l.../#ITBITS..../#STRINGS...PF./#SYSTEM....../#TOPICS...l.P./#URLSTR...X.x./#URLTBL...<.../#WINDOWS...Y.L./$FIftiMain..../$OBJINST...-.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...)../$WWKeywordLinks/..../$WWKeywordLinks/Property...%../button.gif...x.a./content.htm..../index.htm...../page01.htm....G./page02.htm..u.../page03.htm....p./page04.htm..}.'./page05.htm..$.B./page07.htm..f.>./page08.htm..$.#./page09.htm...G.w./page10.htm...>.../page11.htm...Z.../page12.htm...[...::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content.....,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-D7EDG.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	15785
Entropy (8bit):	5.114941236617852
Encrypted:	false
SSDEEP:	192:9EbOGR5+eMGlWwmLRIZIn9XAi7ghRSjJ:9EbOGRo/GlWwmLRIZa9xgnS
MD5:	83E7A401947283047C6C418F384DCCCF
SHA1:	09960C37764864FC2DFF3B9EDCB0CD77EC2D6170
SHA-256:	65AEB8CA1D3F48EBC075CBC3ABAB1A719BF3754BBE0ABB312F9C1D106C9FB8DB
SHA-512:	F6F726A0A0491946801D8D33020D2C22CAED8EE1FC60E5822D0F87357F91C9BC099B82EBA890DAFBE16DFDEEFE6F25026A0C8469B7FB5829DE556030DF17C433
Malicious:	false
Reputation:	low
Preview:	ITSF....`........c.........\|.{.......".....\|.{......."..`...............x.......T........................=..............ITSP....T...........................................j..].!......."..T...............PMGL\................/..../#IDXHDR...C.../#ITBITS..../#STRINGS...xF./#SYSTEM....../#TOPICS...C.@./#URLSTR.....e./#URLTBL......./#WINDOWS...0.L./$FIftiMain..../$OBJINST.....?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/Property...\|../button.gif...O.a./content.htm...3./index.htm..3.../page01.htm..7.[./page02.htm....#./page03.htm..5.9./page04.htm..n.5./page05.htm..#.*./page07.htm..M.m./page08.htm..:.../page09.htm...?.../page10.htm...Q.U./page12.htm...&.).::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content.....,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D31-11D0-9B27-00A0

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-DJ4O7.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16749
Entropy (8bit):	5.279502904420862
Encrypted:	false
SSDEEP:	192:Tnq5cgazumlerj/ZytoWJZMHgkIjkrzhJLnKx+BKh8K6lC4gb+:TnqyXc/ZyuWIvIjovLKx+BdZlC48+
MD5:	EFAE0C5C5E23AA9F39575AAC26A3CB74
SHA1:	6EEE8FB8883CE0410DEE0EB3FA46BA9F8C7D22C4
SHA-256:	EBF1BF3D1E7DE12EA66B1F26BF2F731F1A2BDB34C4ABEFED6CB06BA8560A5D30
SHA-512:	E6857939A6646982B444CCBFDAFFA357519C6BA152E0539D7FA68E53E02A3FF3828967C022909CA1A59C3A5619CE1902C7F7AA3E6ED23D175CE8421333289520
Malicious:	false
Reputation:	low
Preview:	ITSF....`.................\|.{.......".....\|.{......."..`...............x.......T.......................mA..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR...o.../#ITBITS..../#STRINGS...SF./#SYSTEM....../#TOPICS...o.P./#URLSTR...[.x./#URLTBL...?.../#WINDOWS...\.L./$FIftiMain..../$OBJINST...0.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...,../$WWKeywordLinks/..../$WWKeywordLinks/Property...(../button.gif...{.a./content.htm...2./index.htm..2.../page01.htm..6.m./page02.htm..#.g./page03.htm....../page04.htm....../page05.htm..%.=./page07.htm..b.E./page08.htm..'.5./page09.htm...\.g./page10.htm...C.../page11.htm...P.../page12.htm...k...::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....N,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-EO72V.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	50530
Entropy (8bit):	4.932369978237837
Encrypted:	false
SSDEEP:	1536:wDFWC9p3//UKG4YIEQeRaVb13GKCF1Hig9dRipDgfpTvw:gUIEE1WKCF4KI
MD5:	7F57051D513C00908E260DB68EB3509E
SHA1:	B41189204B86A2AD5A747099104E42375105BC6F
SHA-256:	F639A2C0AFFB05BB715F2E197EFCCEC4419C60681992730D0E94B96938B85E9B
SHA-512:	1377CE921AF8A18EB9AE3D2A029AEADA46248C8801627AF1F719167A05C05CB46E68789C28802F929CDE10BC9B18BDEA7D5988CEA1D1C8D260B2E4F92C30C4DB
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimieren..Close=Schlie.en..Open=.ffnen..Help=Hilfe..Start=Start..StartScan=Pr.fung starten..Cancel=Abbrechen..Stop=Stopp..Next=Weiter..Details=Details..CheckAll=Alles markieren..UncheckAll=Nichts markieren..Apply=.bernehmen..Yes=Ja..No=Nein..OK=OK..Information=Info..Confirmation=Best.tigung..Question=M.chten Sie diese Pr.fung wirklich anhalten?..Attention=Achtung..RemoveItems=Elemente entfernen..Refresh=Aktualisieren..Search=Suchen..Remove=Entfernen..Delete=L.schen..Save=Speichern..UninstallAndRestart=Deinstallieren und neu starten..KeepLimited=Weiter mit eingeschr.nkter Version..LearnMore=Weitere Informationen..Continue=Weiter..OpenProgram=%s .ffnen..RunProgram=%s starten..Update=Update..FixAll=Alle reparieren..Reboot=Neustart..OkThanks=OK, danke..NoThanks=Jetzt nicht..ScanAgain=Erneut pr.fen....[Actions]..Actions=Aktionen..Scan=Pr.fen..Backup=Sichern..BackupDrivers=Sichern..DownloadHistory=Verlauf..Settings=Einstellungen..Toolbox=Toolbox....[Messa

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-G9078.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16093
Entropy (8bit):	5.200477844290547
Encrypted:	false
SSDEEP:	192:rTYcHC1rOoZT3Ep/DsDvHC3dzqkxCBYwppw:rti1rOoSZDYCNqwCy+
MD5:	165FB666397DF8FCEF10EF65E09CA6DB
SHA1:	BAE8266877E7439A1358E0551FDC62153E01F0C1
SHA-256:	5AC0DF7C2A51A88244038AA9A12F64D2E2FF97B9979E0B157C7BE559868D5016
SHA-512:	EF7146A2B6F4BA772D37A63671D18730A71269BDE00FE0AA8EF616C51A0707C3D5E0E7B4A12DEF9A3E1ACBA35543A303720A4445904192C443B10DEBD27C8E27
Malicious:	false
Reputation:	low
Preview:	ITSF....`........3........\|.{.......".....\|.{......."..`...............x.......T........................>..............ITSP....T...........................................j..].!......."..T...............PMGLK................/..../#IDXHDR......./#ITBITS..../#STRINGS...~F./#SYSTEM....../#TOPICS.....P./#URLSTR.....x./#URLTBL...j.../#WINDOWS.....L./$FIftiMain..../$OBJINST...[.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...W../$WWKeywordLinks/..../$WWKeywordLinks/Property...S../button.gif...&.a./content.htm...?./index.htm..?.g./page01.htm..&.z./page02.htm.. .A./page03.htm..a.U./page04.htm..6.Z./page05.htm....s./page07.htm....F./page08.htm..I.../page09.htm..K.../page10.htm...e.e./page11.htm...J.../page12.htm...O.W.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....F,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-HSI26.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	38366
Entropy (8bit):	4.885191708446191
Encrypted:	false
SSDEEP:	768:yWpM0WhaOJioO/OIXS+3XV1guEJ/bpgi88nyN36pNQRn4f7bMmlfupUP:s+d2KQR7S+4qYmlr
MD5:	7EAC23D7DFD8068B40BC5421DBA1DFA1
SHA1:	C11DAD8A501AA5AD00C50968D0FAB6443AE293B9
SHA-256:	1449DAEE7F8680007CB72FA32E7B01EFD9348F8976C9BFFFC57C42B4158D13C6
SHA-512:	BBE3953C9AF137558D490704C1296C405B5052C47917715A3976B9323E3905F1D2274EEB77247AB1ADCD41952B78ACD3CDB2E723602AD8ED45D901CCB73AA05A
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimer..Close=Luk..Open=.ben..Help=Hj.lp..Start=Start..StartScan=Start Scan..Cancel=Aflys..Stop=Stop..Next=N.ste..Details=Detaljer..CheckAll=Marker alle..UncheckAll=Afmarker alle..Apply=Anvend..Yes=Ja..No=Nej..OK=OK..Information=Information..Confirmation=Bekr.ftigelse..Question=Er du sikker du vil stoppe denne scanning?..Attention=Bem.rk..RemoveItems=Fjern elementer..Refresh=Opdat.r..Search=S.g..Remove=Fjern..Delete=Slet..Save=Gem..UninstallAndRestart=Afinstaller og genstart..KeepLimited=Forts.t med begr.nset version..LearnMore=Flere oplysninger..Continue=Forts.t..OpenProgram=.bn %s..RunProgram=Start %s..Update=Opdat.r..FixAll=Ret alle..Reboot=Genstart..OkThanks=Ok, tak..NoThanks=Nej tak..ScanAgain=Scan igen....[Actions]..Actions=Handlinger..Scan=Scan..Backup=Backup..BackupDrivers=Backup..DownloadHistory=Nedlastninger..Settings=Indstillinger..Toolbox=V.rkt.jskasse....[Messages]..Stop=Er du sikker p. du vil annullere denne handling?..AdminRights=Du

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-ISR8J.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2558821
Entropy (8bit):	6.362320851330817
Encrypted:	false
SSDEEP:	49152:gg2qPtc1e5OS7bPGoUl+x/grN4azvchYk2F5:gvqPCnrN4azvSYz
MD5:	0E667E5DBF5304D265E4BF7A5A5FD2BE
SHA1:	3EBD560B2EFF54B0479F8C4031464A3F66A3DFEC
SHA-256:	86AB4D85C1184F507F52E8F3342625A2FA821FDE2C5A096ABDFFC42EC5720A65
SHA-512:	6195406B4975E5ABF95241968EA078ED45377ED714D06BF9AF26E9EACC17DE6D02826D954E01C91A1D1AB214C2B361AF82DF6459A1200ABD09C9C964AE72EA4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....]..................$...........$.......$...@...........................'...........@......@....................&.......%..5...@&..D...................................................0&.....................D.%.@.....&......................text...8.$.......$................. ..`.itext...&....$..(....$............. ..`.data...DZ....$..\....$.............@....bss.....q...@%..........................idata...5....%..6...(%.............@....didata.......&......^%.............@....edata........&......h%.............@..@.tls....D.... &..........................rdata..]....0&......j%.............@..@.rsrc....D...@&..D...l%.............@..@..............'.......&.............@..@........................................................

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-J6C3I.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16595
Entropy (8bit):	5.307123659203642
Encrypted:	false
SSDEEP:	384:yIYfZZKmfHsZwYwW/Ta82kZXGreqa/pmuf:yIYfTKIHsBwW/cDrehc2
MD5:	D834097EC2B80FD5396011EA703C32CD
SHA1:	9C2B81A0534CB1A866B5ABC213A3531535DEBF47
SHA-256:	21E83D46329A7A6E31D7A3D02B06C20D87BCB072B9F1A1FA61F383A5415416EC
SHA-512:	222CF25FAD7FDBCB74CA41BF75AF182A23F23616FF0C7A2FE3F4C7F054DB27CFDEC05397A8E0F7E08F25D2B29EE9A27B227BEF1061CEA9CF826FA5402E5C61AB
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......fd........\|.{.......".....\|.{......."..`...............x.......T........................@..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR...}.../#ITBITS..../#STRINGS...aF./#SYSTEM....../#TOPICS...}.P./#URLSTR...i.x./#URLTBL...M.../#WINDOWS...j.L./$FIftiMain..../$OBJINST...>.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...:../$WWKeywordLinks/..../$WWKeywordLinks/Property...6../button.gif.....a./content.htm...x./index.htm..x.../page01.htm....../page02.htm....../page03.htm..6.P./page04.htm....\./page05.htm..b.Y./page07.htm..;.3./page08.htm..n.../page09.htm......./page10.htm.....o./page11.htm.....i./page12.htm...p...::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....<,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-JBHRA.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16765
Entropy (8bit):	5.294571506815564
Encrypted:	false
SSDEEP:	192:iXrq/XLUJZZ5Z0wOjm0mCwn0OBRlh92z/3sCt7gvf/uHfDu:iXre70D0wOLrwn0OBt9I/F7efW/6
MD5:	5889319E4020FAFC7D6CB9C526B90E6C
SHA1:	FD3E8C246437EE7D84F855914F6803B674DD412D
SHA-256:	00B86406D08D7F19AE70FAC2BBD1EFA27A39624EBADCBB4CF513D5BA7F31223F
SHA-512:	4AF0B4A157B2A3FEDB43EF75D38AD13F501AF3047A6916D04878D3D7C98505B32ED26768C21D0F62EC616ADAD0438F45D91798BB951FF4D155F0FB53FB4D7A4D
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......,t.........\|.{.......".....\|.{......."..`...............x.......T.......................}A..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR...".../#ITBITS..../#STRINGS....F./#SYSTEM....../#TOPICS...".P./#URLSTR.....x./#URLTBL...r.../#WINDOWS.....L./$FIftiMain..../$OBJINST...c.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property..._../$WWKeywordLinks/..../$WWKeywordLinks/Property...[../button.gif.....a./content.htm...v./index.htm..v.../page01.htm..z.T./page02.htm..N.../page03.htm..W.../page04.htm..Z.)./page05.htm....<./page07.htm..?.a./page08.htm.. .V./page09.htm...v.X./page10.htm...N.0./page11.htm...~.O./page12.htm...M.a.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....^,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-K90LH.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16711
Entropy (8bit):	5.32878640758244
Encrypted:	false
SSDEEP:	192:ZdX6fUuKaCNno/tlZLhhhSgVIt+bc8iK2yh94OhMnl4VjDVmjgQE:ZdX6fUJaCNnoHLhhA+bcMzo22OV/EjdE
MD5:	54D6AA68BAB8219FA971316E49B94E22
SHA1:	D2DB1DEF6458545AE616D09B440B3F1753358FA7
SHA-256:	D9EDB19933D1F32C35419ED43181E6A58FEB17AE4235D88C1F6F33D7B0F88C6A
SHA-512:	A30A1ABB433938116314F6DFD9F0A3CFA61C99DAF05D38686A48731739A96BE813D18F92911F8CA6EA3916423D88F02027712965D6CDDF3537274A26DFF79C38
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......,..........\|.{.......".....\|.{......."..`...............x.......T.......................GA..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR...+.../#ITBITS..../#STRINGS....F./#SYSTEM....../#TOPICS...+.P./#URLSTR.....x./#URLTBL...{.../#WINDOWS.....L./$FIftiMain..../$OBJINST...l.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...h../$WWKeywordLinks/..../$WWKeywordLinks/Property...d../button.gif...7.a./content.htm...../index.htm....../page01.htm....../page02.htm....../page03.htm..'.1./page04.htm..X.J./page05.htm..".../page07.htm..".O./page08.htm..q._./page09.htm...P.n./page10.htm...>.../page11.htm...K.1./page12.htm...\|.;.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....(,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-KLPF7.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79540
Entropy (8bit):	4.987119928401536
Encrypted:	false
SSDEEP:	1536:1VtcSx3JVh033wYcwjSXAiySUGmJI2r3O:OSLvqRDj6AiJIle
MD5:	80A353EA8E6A93A016076E538A9B123C
SHA1:	BA551DD7C98F477C6D2C55FBDFAAE9E5D1990DD6
SHA-256:	F4B39BF16BAA717EBF380C322491E868279DA6CC90155BA1B31634A4B60BCF1A
SHA-512:	1736F5D8DA168E772104C4B9DB0EBE3BC35709B5EFF6C781FA2347624C7147F825621EBE166DFC796772885B37C09AB4B642EA6953FD40198B152DEC9AA5EF64
Malicious:	false
Reputation:	low
Preview:	\BWQsphsbnt^..XJOEPXTEFGFOEFS>Njdsptpgu!nbmxbsf!qspufdujpo!jodmvefe!xjui!boe!cvjmu!joup!Xjoepxt!tubsujoh!xjui!Xjoepxt!9/!Uijt!tpguxbsf!ifmqt!jefoujgz!boe!sfnpwf!wjsvtft-!tqzxbsf!boe!puifs!nbmjdjpvt!tpguxbsf/..BWBTU>Qbsu!pg!Bwbtu!boujwjsvt!qsphsbn/!Ju!jt!jnqpsubou!up!lffq!bdujwf!up!fotvsf!uibu!zpvs!boujwjsvt!jt!bmxbzt!vq!up!ebuf/..BWBTU6>Tztufn!Usbz!Jdpo!gps!Bwbtu!Boujwjsvt!6/!Ju!jt!jnqpsubou!up!mfbwf!uijt!bdujwf!bu!tubsuvq!up!fotvsf!uibu!zpvs!boujwjsvt!jt!bmxbzt!vq!up!ebuf..BWBTU">Qbsu!pg!uif!Bwbtu"!boujwjsvt!tpguxbsf/!Tztufn!usbz!bddftt!up!boe!opujgjdbujpot!gps!uif!wfstjpo!6!boe!7!tfsjft!pg!boujwjsvt!boe!joufsofu!tfdvsjuz!qspevdut/..BWHOU>Tztufn!Usbz!Opujgjfs!gps!Bwjsb!BoujWjs!boujwjsvt!qspevdut/!Mfbwf!bdujwf!jo!zpvs!tubsuvq!nfov!up!fotvsf!zpvs!boujwjsvt!jt!bmxbzt!vq!up!ebuf!boe!uibu!zpv!sfdfjwf!opujgjdbujpot!pg!boz!qspcmfnt/..BWH`USBZ>Tztufn!Usbz!bddftt!gps!BWH!bojujwjsvt!qspevdut/!Mfbwf!bdujwf!jo!zpvs!tubsuvq!nfov!up!fotvsf!uibu!zpvs!boujwjsvt!jt!bmxbzt!vq!up!ebuf!boe!uibu!zpv!sfdfj

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-KTBGD.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	15957
Entropy (8bit):	5.154929113058537
Encrypted:	false
SSDEEP:	192:sb9cVf5j3kNsetCagr1ga2a+Ft8t+bW7XyUKFHBVPiG4:sb98TCsvZxca+L4+bKnKFHPP
MD5:	8A7B9489EEC8089AC374E5E981D16041
SHA1:	68BCE51BA139D22D236D4BA8B23B7245713FAFEF
SHA-256:	0B6101767C3E5DADEC33CFC8D8BF251BCFFCB8AF600D549EEDE584988B7369EC
SHA-512:	C86C92773EA30A38DFBBB218530AB32ED55E110939BA10F371DBD1B260573F7147789B7CE65778A4F10B3853E6BF2F0A94F65BE6121570D5B3748C8E0B81656C
Malicious:	false
Reputation:	low
Preview:	ITSF....`..................\|.{.......".....\|.{......."..`...............x.......T.......................U>..............ITSP....T...........................................j..].!......."..T...............PMGL\................/..../#IDXHDR...n.../#ITBITS..../#STRINGS...#F./#SYSTEM....../#TOPICS...n.@./#URLSTR...>.e./#URLTBL......./#WINDOWS...[.L./$FIftiMain..../$OBJINST.../.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...+../$WWKeywordLinks/..../$WWKeywordLinks/Property...'../button.gif...z.a./content.htm...{./index.htm..{.../page01.htm....../page02.htm....e./page03.htm..q.e./page04.htm..V. ./page05.htm..v.'./page07.htm....T./page08.htm..q.@./page09.htm...1.N./page10.htm.....Y./page12.htm...X.".::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....>,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D31-11D0-9B27-00A0

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-N93U2.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	53417
Entropy (8bit):	5.443986226349669
Encrypted:	false
SSDEEP:	768:k75l62lUoWVkbVIt3h0pYFNK3fyJuWOjB32FC:k1JlckbVIt3ipYXKqJuTWC
MD5:	236A65D48E8AB07A7473DDF0625DA705
SHA1:	52CDC0BB55A07B4EC09DF66509AFFFBB9DDAB43E
SHA-256:	CB582716DDE665DD97F3668FBA0B42F35888347ECFCD1ADE8447FECAFAF78FF3
SHA-512:	468B88FE45FF2D3FF86BD813FD0003DD016A3D8906EB093DE013010313A775B120009CBFD8BD2FF5ABB32536120113F98BFCC9E9591405E1EC5AE97B51C41188
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=.....Close=.....Open=....Help=.....Start=....StartScan=.........Cancel=.......Stop=....Next=....Details=....CheckAll=.......UncheckAll=.........Apply=....Yes=....No=.....OK=OK..Information=....Confirmation=....Question=................Attention=....RemoveItems=...........Refresh=..........Search=....Remove=....Delete=....Save=....UninstallAndRestart=..............KeepLimited=...............LearnMore=.......Continue=....OpenProgram=%s.....RunProgram=%s.....Update=....FixAll=......Reboot=.....OkThanks=OK.............NoThanks=......ScanAgain=.........[Actions]..Actions=....Scan=......Backup=........BackupDrivers=....

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-NAFD7.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	367960
Entropy (8bit):	5.734832889891923
Encrypted:	false
SSDEEP:	3072:GswVJKdYvRLVLD74WJ9UNaBy5AvG51i2z6VL1w76fLHqWwDuBLfP6hkgTrtytUO:1weennz9Uni2gNrq8BfP6Fg
MD5:	BC4BF56A651F71B3B4ADC12CF58CB28E
SHA1:	754FF889C9F5CBBC9D56AC7B578C5210FC69CBE9
SHA-256:	FB6AA5729E158C9DF953470562EA2156D456DFFF42CFAEB4B1D1BDB6CC20B0E1
SHA-512:	AF2D5C30C8EE9CC6F0F8DA1C818C7FCDED6D7483D7B0D4112FB2F2B239373BFDDC717D382C25005BA26BFB37E7E7AE3248F6558E7B7584CA5B0DFB87F4A4AFE1
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d......`.........."..........j...... .........@.....................................d................@............... ...............`..Q....0..................X&...v..X'.......2..............................(....................5.......P.......................text............................... ..`.data....R... ...R..................@....bss....\................................idata.......0.......^..............@....didata......P.......p..............@....edata..Q....`.......t..............@..@.tls.........p...........................rdata..m............v..............@..@.reloc...2.......4...x..............@..B.pdata..X&.......(..................@..@.rsrc...............................@..@.....................v..............@..@

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-NBHKD.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	40063
Entropy (8bit):	4.9511698681869385
Encrypted:	false
SSDEEP:	768:GCqKnBPiQiA39pjzPGyGfr5U67cPjYTVv6:h//v39ZfGra67OjYTVS
MD5:	956CB11C07361F04EBB5A2556AA12833
SHA1:	83EB3C6A5034777E81C9B35977C6AEC08F1F0177
SHA-256:	082A955E0B86A5608FE86266817B1F5ACADB424DB641B234BB729F1D63ACC310
SHA-512:	9F9465D192D9E17E20D52A21D87160B4B72E79C328414DBD288A945A5B8BC7EB5702533C311EF87806D3F36D3275AB2114CCE611E1FE302BF47D5DD330EC39CA
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimera..Close=St.ng..Open=.ppna..Help=Hj.lp..Start=Starta..StartScan=Starta genoms.kning..Cancel=Avbryt..Stop=Stopp..Next=N.sta..Details=Detaljer..CheckAll=Markera alla..UncheckAll=Avmarkera alla..Apply=Till.mpa..Yes=Ja..No=Nej..OK=OK..Information=Information..Confirmation=Bekr.ftelse..Question=.r du s.ker p. att du vill avbryta denna genoms.kning?..Attention=Uppm.rksamma..RemoveItems=Ta bort objekt..Refresh=Uppdatera..Search=S.k..Remove=Ta bort..Delete=Ta bort..Save=Spara..UninstallAndRestart=Avinstallera och starta om..KeepLimited=Forts.tt med den begr.nsade versionen..LearnMore=Mer information..Continue=Forts.tt..OpenProgram=.ppna %s..RunProgram=Starta %s..Update=Uppdatera..FixAll=Reparera allt..Reboot=Starta om..OkThanks=OK, tack..NoThanks=Nej tack..ScanAgain=Skanna igen....[Actions]..Actions=.tg.rder..Scan=Genoms.kning..Backup=Backup..BackupDrivers=Backup..DownloadHistory=Nedladdningar..Settings=Inst.llningar..Toolbox=Verktygsl.da....

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-O5BC2.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	16319
Entropy (8bit):	5.2407402642610394
Encrypted:	false
SSDEEP:	384:8WScaUi/BvqrkNd/pddk9+DJnhL7It2QK:8WR1koridhddcGPrQK
MD5:	61E873B5C2CEAD4BFEA329C635ECBF1A
SHA1:	BAD277EC3483EAC98B099513A703F75DB71EF1F6
SHA-256:	D28653D663D04027BFA24E25EFF680B3F54382A110E2D40965E865AE761FFFA5
SHA-512:	EA3C8DE9C43F2E0DB5EDF97DEF280059FA26DAD505FC5E2A67F2D076C2F28B929FCECF65EB29A7180EFD3BD7589FBC2C433E2E5A565B498AEB64EC52ADEE485C
Malicious:	false
Reputation:	low
Preview:	ITSF....`.................\|.{.......".....\|.{......."..`...............x.......T........................?..............ITSP....T...........................................j..].!......."..T...............PMGL\................/..../#IDXHDR...l.../#ITBITS..../#STRINGS...!F./#SYSTEM....../#TOPICS...l.@./#URLSTR...<.e./#URLTBL...,.../#WINDOWS...Y.L./$FIftiMain..../$OBJINST...-.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...)../$WWKeywordLinks/..../$WWKeywordLinks/Property...%../button.gif...x.a./content.htm...L./index.htm..L.../page01.htm..P.../page02.htm..i."./page03.htm....m./page04.htm..x.N./page05.htm..F.7./page07.htm..}.M./page08.htm..J.&./page09.htm...p.\|./page10.htm...l.../page12.htm...k...::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....(,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D31-11D0-9B27-00A0

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-O6HLM.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	39797
Entropy (8bit):	4.868389397839326
Encrypted:	false
SSDEEP:	768:5RANeYy1hxc+MXsWuO9VrTF5olYC76HPTbW+D1J2nb:7ay1hxc+eU4VrTF5ol576HPTbW+D1J2b
MD5:	FB4F0A7BFEA6FDB4F81040D86C18DF22
SHA1:	F96BCC0394D30709A14B05DBD449880062620757
SHA-256:	CCE8858197418EA0BCC33D50C8005D09DD2E8ECB97997C41BF4AA3D3E206AB3F
SHA-512:	1EFA43C239AB1A1C43C4B234D687652A01F8C765B7A9C0C861D41AA910025A207DBCC230EF5A0AC5408693E7C68DE402442DF67F96ECBE202672D01E37920C5B
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimoi..Close=Sulje..Open=Avaa..Help=Ohje..Start=Aloita..StartScan=Aloita skannaus..Cancel=Peruuta..Stop=Lopeta..Next=Seuraava..Details=Yksityiskohdat..CheckAll=Valitse kaikki..UncheckAll=Poista kaikki valinnat..Apply=Vahvista..Yes=Kyll...No=Ei..OK=OK..Information=Tieto..Confirmation=Vahvistus..Question=Haluatko varmasti lopettaa skannauksen?..Attention=Huomio..RemoveItems=Poista kohteet..Refresh=P.ivit...Search=Hae..Remove=Poista..Delete=Poista..Save=Tallenna..UninstallAndRestart=Poista asennus ja k.ynnist. uudelleen..KeepLimited=Jatka rajoitetulla versiolla..LearnMore=Lue lis....Continue=Jatka..OpenProgram=Avaa %s..RunProgram=Suorita %s..Update=P.ivit...FixAll=Korjaa kaikki..Reboot=K.ynnist. uudelleen..OkThanks=OK, kiitos..NoThanks=Ei kiitos..ScanAgain=Skannaa uudelleen....[Actions]..Actions=Toiminnat..Scan=Skannaus..Backup=Varmuuskopio..BackupDrivers=Varmuuskopio..DownloadHistory=Lataukset..Settings=Asetukset..Toolbox=Ty.kalupakki....[Messages]..S

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-PKMR3.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	17057
Entropy (8bit):	5.349823087168153
Encrypted:	false
SSDEEP:	192:63U+vTGwFVWXTiDXnEpIhWe/5LN+bemeJRoyVXv+QNB:uU+vTGwFgXTiD0pSLN+Ctv+QNB
MD5:	C1AAF58CBA0A619F306F4F0F2F913277
SHA1:	102B35275C737A4D67D7687BBFD15178344395AC
SHA-256:	F30BABDA9503E789F69E3B343AAFBF74994E018A431019BF3AC56BA583E5B16D
SHA-512:	E990E57D63472B2C34832746690BFEB40A48846EAA40FCE8D30A75388BC98685CDC50F2FB1D995025B6053244977344637A22C61E75A03AB903EDEFCEF2AA630
Malicious:	false
Reputation:	low
Preview:	ITSF....`..................\|.{.......".....\|.{......."..`...............x.......T........................B..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR......./#ITBITS..../#STRINGS...iF./#SYSTEM....../#TOPICS.....P./#URLSTR...q.x./#URLTBL...U.../#WINDOWS...r.L./$FIftiMain..../$OBJINST...F.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...B../$WWKeywordLinks/..../$WWKeywordLinks/Property...>../button.gif.....a./content.htm... ./index.htm.. .../page01.htm..9.3./page02.htm..l.T./page03.htm..@.H./page04.htm....../page05.htm....a./page07.htm..\|.K./page08.htm..G.../page09.htm...`.~./page10.htm...^."./page11.htm......./page12.htm.......::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content.....,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-PRKE9.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.pchelpsoft.com>), UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.640428067582282
Encrypted:	false
SSDEEP:	3:o6ABGQYm/0S4f0mn:o6FVm/r4h
MD5:	6E10A389A0DD38E59B62C385620DE915
SHA1:	FF8B34A16D8DDABBF57EE0DA11EC77089C6D1951
SHA-256:	645E92AC1E92D931F81C88F27D3C4DD2F2BC606BEEC8CD84F1FC9FD36D798487
SHA-512:	F9DFA17D10544DEC8B1B36FCE18AF3A25F1203939361C1DCB92F02A21597AD8748186E87F7ABED1944505B27CB20428486081FAAA8ECB11022C3BF339B901C3C
Malicious:	false
Reputation:	low
Preview:	.[InternetShortcut]..URL=http://www.pchelpsoft.com..

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-QPSFO.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	51874
Entropy (8bit):	4.898522708285582
Encrypted:	false
SSDEEP:	1536:TRyP33S2whhrjYIrlSvm+sGj5AyNinS24q5XKyz:TK3CxSmGNG1fz
MD5:	2F2D184EAAF409DE76B401657557E7DF
SHA1:	08AD9484F1AE8A872C12784BF2DB58B049F5550E
SHA-256:	2986D3DF607426F9300C14C76804A350297123A69DBA8AE57DCF5819E79F200D
SHA-512:	95FB28355C317944D4CF54BD4F472811094B43442E6CADCA5193ECD9E009BE62F06E1AC0A6995EE019D4BF5EDEBB73A1F774FC830C6CEAC0C0DC8B6EEEE4A0B3
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=R.duire..Close=Fermer..Open=Ouvrir..Help=Aide..Start=D.marrer..StartScan=Lancer analyse..Cancel=Annuler..Stop=Arr.ter..Next=Suivant..Details=D.tails..CheckAll=Cocher tout..UncheckAll=D.cocher tout..Apply=Appliquer..Yes=Oui..No=Non..OK=OK..Information=Informations..Confirmation=Confirmation..Question=Voulez-vous vraiment arr.ter cette analyse ?..Attention=Attention..RemoveItems=Supprimer .l.ments..Refresh=Rafra.chir..Search=Recherche..Remove=Supprimer..Delete=Supprimer..Save=Enregistrer..UninstallAndRestart=D.sinstaller et red.marrer..KeepLimited=Continuer avec la version limit.e..LearnMore=Plus d.infos..Continue=Continuer..OpenProgram=Ouvrir %s..RunProgram=Lancer %s..Update=Mettre . jour..FixAll=Tout corriger..Reboot=Red.marrer..OkThanks=OK, merci..NoThanks=Non, merci..ScanAgain=Recommencer l.analyse....[Actions]..Actions=Actions..Scan=Analyse..Backup=Sauvegarde..BackupDrivers=Sauvegarde..DownloadHistory=Historique..Settings=Param.tres..Toolbox

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-QQ8F9.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1025280
Entropy (8bit):	6.60842562656141
Encrypted:	false
SSDEEP:	24576:UKzzLgLVVnHLPoiptCternNqsrGPdu/CUj7Ev:UKzfsVVnHEipAgrnNbi4/j/8
MD5:	40E60CD5B71F7D6B19D79F738919F408
SHA1:	E0C81069CC8E4B0DCDBD0F467112B918AB83FB73
SHA-256:	B2F63C046EE6B3B6238359EC8254784EC77895A725E5E83214D5F453F7AED8AE
SHA-512:	4EC465615111356A34CDB50086F8A7C2101D15094EAC6CEFFB863A4E914BAFD39EFD8801B9C29086DEA50AD6EEA3F694CDDFC2FB2F9911159D4DB5146EBD792A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........n...=...=...=...=...=v..=...=...=.=...=...={..=...=...=...=v..=.=..=>..=.#.=..=.#$=...=2..=...=...=...=Rich...=........................PE..L....h}U...........!.................3....................................... .......................................n..y...th..d........{...........j...;......Xq......................................................<............................text............................... ..`.rdata..Y...........................@..@.data... {...........`..............@....sxdata..............j..............@....rsrc....{.......\|...l..............@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-QTCMN.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	50824
Entropy (8bit):	4.771220715270319
Encrypted:	false
SSDEEP:	768:gmX0Vz/sKf57n5q6/TLhtoPr1OGpZ8JVBgujZUB9LrAJ:gq0Vz/V7n5qovk5uSzM
MD5:	57A72A20D63F78D07DC9F28C938511F8
SHA1:	46B0F0F5470DF9B931B480F4FE6BE5ED08DAAD0C
SHA-256:	D464F23C6D648EFFF4AE516031FD1ADCB0D0CC0FF72A1AEB062EC38BA0EE5684
SHA-512:	86B1A956E3DD7475A2BD2237663DB0EB9DAD6EC0B110F1F2C3DF0FEA3F7335C676B4A5DE9220F54B427691F738B5BAC7A5E486D3591D1C63D2624BABD49401CA
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimizar..Close=Cerrar..Open=Abrir..Help=Ayuda..Start=Iniciar..StartScan=Iniciar esc.ner..Cancel=Cancelar..Stop=Detener..Next=Siguiente..Details=Detalles..CheckAll=Marcar todo..UncheckAll=Quitar todo..Apply=Aplicar..Yes=S...No=No..OK=OK..Information=Informaci.n..Confirmation=Confirmaci.n..Question=.Seguro que desea detener este esc.ner?..Attention=Atenci.n..RemoveItems=Quitar elementos..Refresh=Actualizar..Search=Buscar..Remove=Quitar..Delete=Eliminar..Save=Guardar..UninstallAndRestart=Desinstalaci.n y reinicio..KeepLimited=Continuar con la versi.n limitada..LearnMore=M.s informaci.n..Continue=Continuar..OpenProgram=Abrir %s..RunProgram=Ejecutar %s..Update=Actualizar..FixAll=Reparar todo..Reboot=Reiniciar..OkThanks=Aceptar, gracias..NoThanks=No, gracias..ScanAgain=Analizar de nuevo....[Actions]..Actions=Acciones..Scan=Esc.ner..Backup=Copia de seguridad..BackupDrivers=Copia de seguridad..DownloadHistory=Historial..Settings=Ajustes..Toolbox=Caja de her

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-RMOST.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	41581
Entropy (8bit):	4.879802262485373
Encrypted:	false
SSDEEP:	768:I7nvQ33/wQf1UCFyWKKZYGrPosOjRUG5b9sozPk:yQTGQLKSYG3WCoDk
MD5:	62F921498508E9E7B96609FCF57D2117
SHA1:	CE615D20BF7B3A09DAB917CB3F8FD3A9D1487856
SHA-256:	9FF1B675B3B898CD056DB303D6960109880BBB87DA7DD432E32B1EB353CCD3DD
SHA-512:	7AF9E64BDBCC1060A854244546EDA3104BD8F03CB2F6FB9C63FF4808FAEF5FFE3385D577FF43F646E8899A46EA2E1D62A7D9C0930BFE3FFB42DFC88C2D96A282
Malicious:	false
Reputation:	low
Preview:	.[Buttons]..Minimize=Minimizar..Close=Fechar..Open=Abrir..Help=Ajuda..Start=Iniciar..StartScan=Iniciar An.lise..Cancel=Cancelar..Stop=Parar..Next=Pr.ximo..Details=Detalhes..CheckAll=Marcar todos..UncheckAll=Desmarcar todos..Apply=Aplicar..Yes=Sim..No=N.o..OK=OK..Information=Informa..o..Confirmation=Confirma..o..Question=Tem certeza de que deseja interromper esta an.lise?..Attention=Aten..o..RemoveItems=Remover itens..Refresh=Atualizar..Search=Procurar..Remove=Remover..Delete=Excluir..Save=Guardar..UninstallAndRestart=Desinstalar e reiniciar..KeepLimited=Continuar com a vers.o limitada..LearnMore=Saiba mais..Continue=Continuar..OpenProgram=Abrir %s..RunProgram=Executar o %s..Update=Atualizar..FixAll=Corrigir tudo..Reboot=Reiniciar..OkThanks=OK, obrigado..NoThanks=N.o, obrigado..ScanAgain=Analise novamente....[Actions]..Actions=A..es..Scan=Analisar..Backup=Backup..BackupDrivers=Backup..DownloadHistory=Hist.rico..Settings=Configura..es..Toolbox=Caixa de ferramentas....[

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-UMH99.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	17003
Entropy (8bit):	5.3450502612922515
Encrypted:	false
SSDEEP:	192:EufQCDYJeq1I5horXfNYv8MEnkhSP+L4FLWFUaG6hMbXHtt:EufFDYJhNzY808zFLGUVPb
MD5:	A5320BF5CBE6789620FF693B5BAAA7B1
SHA1:	F3CD15708EFAEB3144D7A1AA47CAD6035F4C8494
SHA-256:	E4BA133371210B0147BB86FB88EAEA4A4CFE3E0765BE2B7A06C3876F935332E8
SHA-512:	DE5DC12443CE287FC75FC4212CB277DD002EB75A6EAC658106BEF6E8695BA90D7CA1F32F65A4E2035E115D5190CE748405515F71AC4D3DF0A88F03A37251903C
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......P.........\|.{.......".....\|.{......."..`...............x.......T.......................kB..............ITSP....T...........................................j..].!......."..T...............PMGLJ................/..../#IDXHDR...O.../#ITBITS..../#STRINGS...3F./#SYSTEM....../#TOPICS...O.P./#URLSTR...;.x./#URLTBL......./#WINDOWS...<.L./$FIftiMain..../$OBJINST.....?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/Property....../button.gif...[.a./content.htm...z./index.htm..z.../page01.htm....../page02.htm....%./page03.htm..9.=./page04.htm..v.~./page05.htm..t.../page07.htm....~./page08.htm....*./page09.htm...3.../page10.htm...K.F./page11.htm......./page12.htm.....?.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content....L,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9

C:\Program Files (x86)\PC HelpSoft Driver Updater\is-VFE8P.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3533656
Entropy (8bit):	6.342532878589074
Encrypted:	false
SSDEEP:	49152:5uesVnohuTd9ASzjGTR0PbaL7kz3zgXUySWTJxiTGs84:5utqhuTWL7kz3zgkySWVxM8
MD5:	CA2A9C91909A669420DDB908B32A5E52
SHA1:	F3BCF2BCFE6F0F3390FEB0AE1241604AD1D13DFB
SHA-256:	62C8FF805487DBD87272CC2678C768EB8389EFDE6E72861874BCCB8C9B1FAF58
SHA-512:	DFB802EDC945BA7F6AFE29707D331B46650941B5689FF53CB4B3C641EB58D2021517FC8065783F6633C9EFF887359D910817E7CE30C1AF696769B595300AD2B4
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\PC HelpSoft Driver Updater\is-VFE8P.tmp, Author: Joe Security
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......`................../.........8./......./...@...........................6.......6...@......@....................1......p1..I....2...............5.X'....................................1......................}1.D.....1.D....................text..../......./................. ..`.itext...>..../..@..../............. ..`.data........./......./.............@....bss....h\|....0..........................idata...I...p1..J....0.............@....didata.D.....1......&1.............@....edata........1......41.............@..@.tls....L.....1..........................rdata..].....1......61.............@..@.rsrc.........2......81.............@..@..............6.......5.............@..@........................................................

C:\Program Files (x86)\PC HelpSoft Driver Updater\unins000.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	data
Category:	dropped
Size (bytes):	50717
Entropy (8bit):	3.9054670498694866
Encrypted:	false
SSDEEP:	384:tkq1EXa99KuUAkZa/56+ZLMAlPYMMo57Vp0T4iW6IjG9qCdHQsrLN8fbPIze3QC+:tkw8hI7Vpg7J6fb13QCSE0
MD5:	584854CEF78865F401DD00654E94B44B
SHA1:	370096899CE8E512F503B426C05C7315204B9061
SHA-256:	AE4034FEA8C11C4C5D2F70679E07EEF622F933FE949A07F73D2B549F6B084C0F
SHA-512:	6977BC961CB9F472BC3DE955A3648A80503ACD2D04376D463C6690FB60B6E095579626D7C32D7C424B8D78E8242E3B903947F06FA27F516C5A702B9D505CBD9C
Malicious:	false
Reputation:	low
Preview:	...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................9.9.2.5.4.7......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r................2...... ..........r..IFPS....=........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TBUTTON....TBUTTON.....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater\Help.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	3.5645164955501984
Encrypted:	false
SSDEEP:	12:8wl0Ra/ledp8C/DBNJtX3c8VcbdpYKAVWbdpYKuQ/CNUvH4t2Y+xIBjK:8tdOKrJpZodnAVSdn1OUF7aB
MD5:	4A9D1EF5346818B8DDC77DCCE7E78D54
SHA1:	08DF8A097F063510129803BD504D95A3B5317E3D
SHA-256:	75C2C67F6A6D39DAB5504FABE83CD4ECA70C89DD2CD20170D14A504E40C95A0C
SHA-512:	38E413D376E61EFED76698E071C015B9DCC4392157451E7A8ABDBFA121C73A4C5FFB75831E96C2CA4675AD5FAFE01E22D156BF7E5670C0BD966DCA808D508FFA
Malicious:	false
Reputation:	low
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)..."...1...........PC HelpSoft Driver Updater..f............................................P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r......2...........PCHelpSoftDriverUpdater.chm.h............................................P.C.H.e.l.p.S.o.f.t.D.r.i.v.e.r.U.p.d.a.t.e.r...c.h.m......\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.\.P.C.H.e.l.p.S.o.f.t.D.r.i.v.e.r.U.p.d.a.t.e.r...c.h.m.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.........*................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater\PC HelpSoft Driver Updater on the Web.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Jul 19 08:50:07 2021, mtime=Mon Jul 19 08:50:07 2021, atime=Thu Mar 26 12:26:18 2015, length=54, window=hide
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	4.514697287757581
Encrypted:	false
SSDEEP:	24:8mhIGxtEdOEi5UAVAkeMMdnndnY0eAVToUUfXMXN7aB6m:8mxtEdOD5jVAjMMdnndnJeAx90XMXAB6
MD5:	4455CA760426AF381598EFAD2955E8A2
SHA1:	79ED3D4CD6DC79575923CEBA99F58735DA876AEC
SHA-256:	4C7943ECC2A57A1FE3DCD0E087E167B5DE8AA6FCD2945E8543EE56ADAEA1A2B0
SHA-512:	9E25037040514B1C16D9D989E708EF685D02F987FA3177C40CA50756814B432AFF0757D893C022604B20308CC88D2FD8A3FA86715B9DAB91AA6926FAA9F92036
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...@..t.\|..@..t.\|...y.p.g..6............................P.O. .:i.....+00.../C:\.....................1......RCN..PROGRA~2.........L..RDN....................V......#.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....~.1......RDN..PCHELP~1..f.......RCN.RDN.....V......................i.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.....f.2.6...zFIk .HomePage.url..J.......RDN.RDN....~X........................H.o.m.e.P.a.g.e...u.r.l.......m...............-.......l...........k..g.....C:\Program Files (x86)\PC HelpSoft Driver Updater\HomePage.url..M.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.\.H.o.m.e.P.a.g.e...u.r.l.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.J.%.P.r.o.g.r.a.m.F.i.l.e.s.(.x.8.6.).%.\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.\.P.C.H.e.l.p.S.o.f.t.D.r.i.v.e.r.U.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater\PC HelpSoft Driver Updater.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jul 19 08:50:05 2021, mtime=Mon Jul 19 08:50:06 2021, atime=Fri Apr 30 16:57:14 2021, length=7873880, window=hide
Category:	dropped
Size (bytes):	1299
Entropy (8bit):	4.614462003209288
Encrypted:	false
SSDEEP:	24:8mMyktEdOEi6AA4AkekVdnAVMdnWUU67aB6m:8mM9tEdOD64AjwdnAmdnfwB6
MD5:	BD81E4242EC8EBBB362B61B8A037A083
SHA1:	440BD821692FF9D24F1FFCEE36BACF1724D684E3
SHA-256:	2F6380F18010825558FF0B8EE6C664AC191BFDA8179FC815A698F059E5D49430
SHA-512:	66629F6B3EDC2B06D81E345A33362AB439DDDB34016C4FBB2082F9FA769C1612453F62AA1AA3894AAE72E0DA61B8A0C556AA0D8DCC511539394CE3289883A90A
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....}s.\|....kt.\|.....cFV..X%x..........................P.O. .:i.....+00.../C:\.....................1......RCN..PROGRA~2.........L..RDN....................V......#.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....~.1......RDN..PCHELP~1..f.......RCN.RDN.....V......................i.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.......2.X%x..R'. .PCHELP~1.EXE..h.......RCN.RDN....-X........................P.C.H.e.l.p.S.o.f.t.D.r.i.v.e.r.U.p.d.a.t.e.r...e.x.e.......\|...............-.......{...........k..g.....C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe..\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.\.P.C.H.e.l.p.S.o.f.t.D.r.i.v.e.r.U.p.d.a.t.e.r...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.........*................@Z\|...K.J.........`.......X..

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC HelpSoft Driver Updater\Uninstall PC HelpSoft Driver Updater.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jul 19 08:50:04 2021, mtime=Mon Jul 19 08:50:04 2021, atime=Mon Jul 19 08:49:59 2021, length=2558817, window=hide
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.658931650659058
Encrypted:	false
SSDEEP:	24:8mWMtEdOEiRYUAVAke+Mdn00dnWUUq7aB6m:8mWMtEdODRYjVAj+Mdn00dnfIB6
MD5:	E27C91E2BBCE2E9A12DE771EE0AFD93A
SHA1:	D57CEC798A8E15550CD0231939FE3B1425ECCAE2
SHA-256:	F12957755FC0E66AA96DAD5FBCA059E9D9D14D12D7085FE10E81E42CBDB3033D
SHA-512:	EEE6D30DECCE616D8A61F321788F4895777EDCB2398B4C6964FCC0847F06CD26DB0AE1058CB31180B566160854D9333044D3F36E4AE9D8B5A9F40BCF0BBF3F7E
Malicious:	false
Reputation:	low
Preview:	L..................F.... ....Q.r.\|.....r.\|.....p.\|..a.'..........................P.O. .:i.....+00.../C:\.....................1......RCN..PROGRA~2.........L..RDN....................V......#.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....~.1......RDN..PCHELP~1..f.......RCN.RDN.....V......................i.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.....f.2.a.'..R@N .unins000.exe..J.......RCN.RCN.....X....................QQg.u.n.i.n.s.0.0.0...e.x.e.......m...............-.......l...........k..g.....C:\Program Files (x86)\PC HelpSoft Driver Updater\unins000.exe..M.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.\.u.n.i.n.s.0.0.0...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.........*................@Z\|...K.J.........`.......X.......992547...........!a..%.H.VZAj..................!a..%.H.VZAj.......

C:\Users\Public\Desktop\PC HelpSoft Driver Updater.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jul 19 08:50:05 2021, mtime=Mon Jul 19 08:50:06 2021, atime=Fri Apr 30 16:57:14 2021, length=7873880, window=hide
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	4.626820173106065
Encrypted:	false
SSDEEP:	24:8mMyktEdOEi6AA4AkekbCdnAVMdnWUU67aB6m:8mM9tEdOD64AjuCdnAmdnfwB6
MD5:	52497AC990F4396F7A41ABB3994345EB
SHA1:	6BDD1C50CA12879C81FD076E479E7AC366957550
SHA-256:	B42A4232ABDA2D7C66D3E38DBE6E85E5399303D12A65E93BF29AB0D2D7EF8FC6
SHA-512:	B339B9485B4ABDFC65E90DB25D91006CC5D754AFA3C866C19FCD7BDE51DA7FBC90581B90F3784E66C1F8EC670833A2C33AF9DBE4C3ED74501FCAAE9D3546F819
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....}s.\|....kt.\|.....cFV..X%x..........................P.O. .:i.....+00.../C:\.....................1......RCN..PROGRA~2.........L..RDN....................V......#.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....~.1......RDN..PCHELP~1..f.......RCN.RDN.....V......................i.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.......2.X%x..R'. .PCHELP~1.EXE..h.......RCN.RDN....-X........................P.C.H.e.l.p.S.o.f.t.D.r.i.v.e.r.U.p.d.a.t.e.r...e.x.e.......\|...............-.......{...........k..g.....C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe..S.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.\.P.C.H.e.l.p.S.o.f.t.D.r.i.v.e.r.U.p.d.a.t.e.r...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.C. .H.e.l.p.S.o.f.t. .D.r.i.v.e.r. .U.p.d.a.t.e.r.........*................@Z\|...K.J.........`.......X.......992547.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\10_64[1].json Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	144
Entropy (8bit):	4.906303888308665
Encrypted:	false
SSDEEP:	3:YKOHqyRAhVTLINVX55nHEPGatMO6TfvTooCGr9DqvPvEXY:YKOHqyCDTLIJ5nkhMO6TKEkWY
MD5:	C32E4DD9A84946F65EE7D967B1F41881
SHA1:	C27BE2901E42FA0EEADBC8E7027CBA9556EA0F68
SHA-256:	DB4439755C73201271FF27E905C34E19726F2F8E5F3A940112C5F6FC783646EC
SHA-512:	44E6A12CECFF978CA0E716A1941A8F9E072C19949EAE5B9FF2AD66F9EE6EA3413E7654A640D18B6117CDD846E7EB745226115597F9BA4C9F8EEA3A522ECC7E03
Malicious:	false
Reputation:	low
IE Cache URL:	https://receiver.smartpcupdate.com/10_64.json
Preview:	{"ok":1,"date":"2021-06-16","url":"http:\/\/receiver.smartpcupdate.com\/10_64.7z","file_hash":"6f6d4c6d3c0156f037c1dc6494c68d46","size":4479182}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\10_64[1].htm Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	180
Entropy (8bit):	5.080637526741814
Encrypted:	false
SSDEEP:	3:PSvMXhUhLVLjNZ13wWNYQsXkM2RdwFSYS9DZX7ucV1ZQ4896vwJkYXK:bXWVLjT1AKYXXh2dwcXFo1767YXK
MD5:	4A82BDC083337CC8750327AB74255774
SHA1:	7C9D03435E85B164FC243EE9355C1792649A1346
SHA-256:	E2CDA9BF113A638C8C949001DF7F7768BE62FEEB52060D432DEF20697D3415EE
SHA-512:	C965FF12CB5567C79E0ED56DE5D87FD7565F46DCBF98CB11211AAC22298D9FC5EF1F7E11F353008209AA06B50A99E5454EB5687600A79E2F38F2F8F5C9B0B8A2
Malicious:	false
Reputation:	low
IE Cache URL:	https://receiver.smartpcupdate.com/check-current/03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1/10_64
Preview:	date=2012-08-07.version=1.0.0.0.description=ASUS MX279.filehash=69122D35A016ED65B2C48DB81D6E214160EAD841.vendor=ASUS.driver_id=21959131.condition=0.size=5869.build=.result=success.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\10_64[1].htm Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	179
Entropy (8bit):	5.005123280259218
Encrypted:	false
SSDEEP:	3:YIUTZQXVLMLVPNSvQJoEWNY2gid10VwBmRcSTcP6aKWhiWuFRlIQ488TfgkYXK:YIKZCVKPMoKYe10Vww/adoFRl7qNYXK
MD5:	71B88B4CB97116D0BFC08995B4EDFC4D
SHA1:	63A1B1C4748FC04D9B153567CCE3F4CC25DACE4C
SHA-256:	DDB47F0F6FE06A457D9A7334792FC1137A6D1B09345F099C3D0E17FDB01B56ED
SHA-512:	5380B177DBBDD589BBC4953CE38B45419378F596008C0A7EC2608F213212A7213FC7C6779CBD4D8C40F27FCBC2CC6CB22AC949DA71AD55CDD718CCE43C8EE795
Malicious:	false
Reputation:	low
IE Cache URL:	https://receiver.smartpcupdate.com/check-current/1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5/10_64
Preview:	date=2020-01-16.version=20.10.0.0.description=Pci Bus.filehash=45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447.vendor=AMD.driver_id=19861291.condition=0.size=47890.build=.result=success.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\10_64[1].7z Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	7-zip archive data, version 0.4
Category:	downloaded
Size (bytes):	4479182
Entropy (8bit):	7.999953693647618
Encrypted:	true
SSDEEP:	98304:rsqIY7aWw6yPmQfiY3R7dHYF/wcjcc1xTWqwOQWzV3h:re5OyPVRBU/jjXoqFX
MD5:	6F6D4C6D3C0156F037C1DC6494C68D46
SHA1:	9A76B275104EB2927264C41EA62B17ACA7582113
SHA-256:	6D2C76A7F0F3337DE613783E9DC77EF4503AC8EED7651216FEDABA88D921F8CC
SHA-512:	F4B8DF2994D33E486DF489E607115474330DD391E9FB07BD475BA306AFC1A0B8B3E420F075AA64AD9A07EF05CD174B5185885C89F88DDE46214E83A6DDE97716
Malicious:	false
Reputation:	low
IE Cache URL:	https://receiver.smartpcupdate.com/10_64.7z?partner=PCHelpSoftDriverUpdater&version=5.4.549&nocache=7292906
Preview:	7z..'....A3`LXD.....b........Q.m.L7..].).E.`...&d..&.1...!..m....A)..^7]...s.QU..GG&....-#..Ar./.h...e./.R.\|.FZ.......h,.<.e..."..H:......&..\|).M.-.<...wf..w.....W.1;k[..l._....t....F...iU...5^LQ.%<...E.j..o..,...{'..bC...U?.....X.cz.v4.D....2p..[..l"3\|_....j"^.Ayf...+.=..!.R;.,...~...m.e.!.e/.ME3.3J..Wl'..&.3.".G..=..+...)...9...04=A.(...... 7.z.?fK.3....[..Z....>b....M.2.....Cm.x....OF..S....b.R..............G....."9}......$.....J.....$...2>o..y.R..<...U+......8..5,..o...8b..&.(..s]...Q1...,.P...^.q.N..z..J.......[\|.....\.>.\`qG..X7/.....A<T........3;4j.l....%.M..r..}....`.....i.lP.f..#.8.V.D.xkW<..[7....Z..].....[61...).'.x.6...V..S.s.y'=.l..._....{.........".....&f.a.-.h.....,lc.g.D..LbD.........lm....4.E.H.../........h.Y=.{G..%?.....b...../(E9f$...Se...)..........>OUg...w.....6+..8 .w.2.=x.\|.f.!...p.0...D).%k.;... .#...q....)RS.....D.E...//...V.F+.j.y..\|.Y.L.t.c..\|.J(<.]....B..^....-.}.-IwVH9.'a.1@..$u.v$x.e.@..8>O

C:\Users\user\AppData\Local\Temp\etilqs_MW1Sofa0RzSXICS Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	8104416
Entropy (8bit):	4.681395334850079
Encrypted:	false
SSDEEP:	24576:3eh027pXHwOJ7yYmnM3CHRDEZwMlPFHhcZDuTNHuUlfqArZo/3MNQm2hSpZWPRfY:QHB5wMJ9xBGPSPnZPmh6F
MD5:	E4C0F8A867BD8F2ECFD4255272A36F03
SHA1:	E35C3C4CFE6361B478250EAEC08B1FE94C8C9657
SHA-256:	3B829F372F0DA3009490750EBC640E965A27EB9D2585F071932B1488D8ACABAC
SHA-512:	688EFC0BFBFF933E2F0BAF403BFBAE44F815FE8E70A7A23E37393CF5E56A92465DF26463D018A332EA70873394302BA3240D7B79A43D1C615185BF3BCA3F4F45
Malicious:	false
Reputation:	low
Preview:	..,._.0000062B58DE0314F34DF2DB4F1DA10F700D903F1-._.00000C265FDFFA2F14B4EC3E0E4E89410210995D0.-._.00001F8ABC2EC7B8A4509DC31E95C6FEEDD298353.-._.0000223651C0B4155FD8EC443EF3C6313FFD19980.-._.0000226071D9A6C18373007692AB03FA6047844CE.-._.0000297E300D8555AF46D6CC305977C8013FCE9B5.-._.00003271049E68FF89851204D1F9F7BE1BB584DD5.-._.00003C8EE0EE4CF0EEBD7FC82109A1ED3E5A6FE49.-._.00003FEB723E7D4A6A12026F3BABDF2A0B04C416A.-._.00003FF9575CEDE0482DB2F89B507B715F5A05471.-._.000044DAE176EC49F622D571F854A9478A9C2C243.-._.00004535D63B8131AE9D6DD6B8DA48DBD44888F9C.-._.00004666CAE689F4FE21A32398DF4C60C7AB03A91.-._.000049E423301408BE2A38F4B6BD1EF5B18956B6A.-._.00004E1982C2D9A8934EFA06EFAD24D3E6FE99D7F.-._.00005640D71250CB68985893B5152FAF79823F662.-._.00005B20B42B6B2F6C1CE8745E191DF9D79AF5E13.-._.000070D9554C493A5B42C494D624EF875FAF5F948.-._.0000850BFBDFD8CACE8D13ECEE9D7BF945732B956.-._.0000850CA7F91C06D9E3F40C270CA9753E36A18C0.-._.00008CA89D9E7D2AE57A22AB7BCD9681E906AB5A9.-._.000094CE410D354BB1C6CE348722

C:\Users\user\AppData\Local\Temp\is-4K8QF.tmp\PC HelpSoft Driver Updater.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PC bitmap, Windows 3.x format, 455 x 56 x 24
Category:	dropped
Size (bytes):	76662
Entropy (8bit):	2.325737320864805
Encrypted:	false
SSDEEP:	384:689Advjl7PW2jB9U3AgQ/LJMldpb6D6iUZMXj94l6:BOLl7PW2jjU3AgQ/LJMlqD6TZ+Z4l6
MD5:	5CCDD44CBE9595ABE77A5B2BDF00B25E
SHA1:	7D5206D903C531AF4569EAC4D85DBC228403EF23
SHA-256:	ABEAD39E36F00EF93F3990075E272AFDC5798F68AB438D3C4AF6B7162D9FE5F6
SHA-512:	8C2D71CD598431145C7B1221DF33D912AD4A9DE9510D6DDE6DA91806E1DDD914B41FB4C409BF56753ED582A7E012832FA4D1492190BD610B2761A546233E3D55
Malicious:	false
Reputation:	low
Preview:	BMv+......6...(.......8.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-4K8QF.tmp\_isetup\_setup64.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp Download File
Process:	C:\Users\user\Desktop\download\Driver_Updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2535424
Entropy (8bit):	6.378725232145821
Encrypted:	false
SSDEEP:	49152:gg2qPtc1e5OS7bPGoUl+x/grN4azvchYk2F:gvqPCnrN4azvSY
MD5:	84DB4B4205F705DA71471DC6ECC061F5
SHA1:	B90BAC8C13A1553D58FEEF95A2C41C64118B29CF
SHA-256:	647983EBDE53E0501FF1AF8EF6190DFEEA5CCC64CAF7DCE808F1E3D98FB66A3C
SHA-512:	C5803B63D33BB409433B496B83CA2A7359B4B1835815386206283B3AF5C54D7D1CB9E80244A888638C7703C4BF54E1B2C11BE6836F20B9FEA157AB92BFBF365A
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....]..................$...........$.......$...@...........................'...........@......@....................&.......%..5...@&..D...................................................0&.....................D.%.@.....&......................text...8.$.......$................. ..`.itext...&....$..(....$............. ..`.data...DZ....$..\....$.............@....bss.....q...@%..........................idata...5....%..6...(%.............@....didata.......&......^%.............@....edata........&......h%.............@..@.tls....D.... &..........................rdata..]....0&......j%.............@..@.rsrc....D...@&..D...l%.............@..@..............'.......&.............@..@........................................................

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447.7z.pre Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	5485
Entropy (8bit):	5.531742091891031
Encrypted:	false
SSDEEP:	96:YsbXlpM9FUNHSMwzoVoXyzE98o8o8o8o8o8o8vp18tYonqmjzkX:zjlWFUhwzY0ijp18tYAjoX
MD5:	E03AD2731989E5D471DBBED8981378C9
SHA1:	56ADCED892D83CE6F944A57AA17D42EB9D2A536A
SHA-256:	53362F7E2B2A38E7520AB75A7C4DC63F665DCF2D2D6CFA4A61CC707C564507FD
SHA-512:	CAB5A1853A05F4BC567B40ED9507102BE7379223F5FCFA64A19773120EFA3A4A6B0B0E47213450DA085EBB2FEF2301808966E84846961B1CA272833BC8BE8000
Malicious:	false
Reputation:	low
Preview:	.[Settings]..Base=2021-06-16..FileDescription=..FullFileName=45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447.7z..Vendor=AMD..Version=20.10.0.0..Date=01-16-2020..Generated=44396.4939499884..IsNewSystem=1....[11-scan]..DeviceName=PCI Bus..FName=45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447.7z..PackageName=45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447.7z..AltFName=45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447.7z..Date1=06-21-2006..Date1Raw=38889.0833333333..Date2=01-16-2020..Vendor=AMD..Version1=10.0.17134.1..Version2=20.10.0.0..Installer=..Description=..DeviceDescription=Pci Bus..Class=System devices..ClassName=System..ClassGUID={4D36E97D-E325-11CE-BFC1-08002BE10318}..InfPath=pci.inf..InfSection=PCI_ROOT..IsConnected=1..IsFailed=0..HardId=ACPI\\PNP0A03..HardIdRaw=ACPI\PNP0A03..Md5Hash=45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447..FullHID=1..DeviceIniSection=11..EnumKey=ACPI\PNP0A03\2&DABA3FF&0..ClassKey={4D36E97D-E325-11CE-BFC1-08002BE10318}\0006..IsPending=0..IsSystemDriver=0..IsNewSystem=1..BaseDate=2021-06-1

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447.7z.status Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.955311316634013
Encrypted:	false
SSDEEP:	3:l4yiWRtDACU7v:lwaHUr
MD5:	CF25C42F45A3FC92ADB23A4FE24DAECF
SHA1:	2D52571CA1837E970538CABCC3C8FE78AE32CA88
SHA-256:	D25A2B6FD3C55E9A3932AC6290DD1729F02C90BDFFD7CAD20661BA20505A06A0
SHA-512:	A2BA4D33B442053030E8233AF7BD64DC230343C8720F62228BB687BBAAE5FEA805B479E0B7EEA7D8BC0AB0C84122B0733859F024EA77D4B4DF59DFD0796AC00D
Malicious:	false
Reputation:	low
Preview:	[Settings]..Status=None..Present=1....

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\69122D35A016ED65B2C48DB81D6E214160EAD841.7z.pre Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3883
Entropy (8bit):	5.584793263788405
Encrypted:	false
SSDEEP:	96:YctpGMdSP72IuUSroVouzVVCw18eYomq8l+7:Zt5dSD2IWYrRYw18eYNl+7
MD5:	9B4332A2CEACE58919DA962855020959
SHA1:	B05165770AEBA71B4B5572E10F6A6BFE98732920
SHA-256:	2B43556506CB664D9C108EB4EF65AEB9450A5B79FEBD7F76A65EBEA562C55CEE
SHA-512:	F14B1B8E03521D6AAFE2F325615FFCD9B1F45D4DFD1F3A87D6368D6AC7344794294FA6874346AD9D777B5FDEDC57D50663D42B9C9216A872A9F20FFA4ACC05CA
Malicious:	false
Reputation:	low
Preview:	.[Settings]..Base=2021-06-16..FileDescription=..FullFileName=69122D35A016ED65B2C48DB81D6E214160EAD841.7z..Vendor=ASUS..Version=1.0.0.0..Date=08-07-2012..Generated=44396.4939499884..IsNewSystem=1....[9-scan]..DeviceName=Generic Non-PnP Monitor..FName=69122D35A016ED65B2C48DB81D6E214160EAD841.7z..PackageName=69122D35A016ED65B2C48DB81D6E214160EAD841.7z..AltFName=69122D35A016ED65B2C48DB81D6E214160EAD841.7z..Date1=06-21-2006..Date1Raw=38889.0833333333..Date2=08-07-2012..Vendor=ASUS..Version1=10.0.17134.1..Version2=1.0.0.0..Installer=..Description=..DeviceDescription=ASUS MX279..Class=Monitors..ClassName=Monitor..ClassGUID={4D36E96E-E325-11CE-BFC1-08002BE10318}..InfPath=monitor.inf..InfSection=NonPnPMonitor.Install..IsConnected=1..IsFailed=0..HardId=MONITOR\\DEFAULT_MONITOR..HardIdRaw=MONITOR\DEFAULT_MONITOR..Md5Hash=69122D35A016ED65B2C48DB81D6E214160EAD841..FullHID=1..DeviceIniSection=9..EnumKey=DISPLAY\DEFAULT_MONITOR\4&427137E&0&UID0..ClassKey={4D36E96E-E325-11CE-BFC1-08002BE10318}\0001.

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\69122D35A016ED65B2C48DB81D6E214160EAD841.7z.status Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.955311316634013
Encrypted:	false
SSDEEP:	3:l4yiWRtDACU7v:lwaHUr
MD5:	CF25C42F45A3FC92ADB23A4FE24DAECF
SHA1:	2D52571CA1837E970538CABCC3C8FE78AE32CA88
SHA-256:	D25A2B6FD3C55E9A3932AC6290DD1729F02C90BDFFD7CAD20661BA20505A06A0
SHA-512:	A2BA4D33B442053030E8233AF7BD64DC230343C8720F62228BB687BBAAE5FEA805B479E0B7EEA7D8BC0AB0C84122B0733859F024EA77D4B4DF59DFD0796AC00D
Malicious:	false
Reputation:	low
Preview:	[Settings]..Status=None..Present=1....

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\Cache\03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1_10_64.ini Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.245684303894935
Encrypted:	false
SSDEEP:	6:vWgDrrdVLkT1wbcKYXXh2dwckueRq9y6o8YX9:ZVLZGXx6wOwCNpo
MD5:	347AC5A08C5A908B36DAD9F5AF16CFAA
SHA1:	BD3D7633A3E4B1E3A58962A2CBC5D09BD12010DC
SHA-256:	598E6F62A86EF61A9BD3CF8E334B1FC2C180528D7B45702FC1706DCF94FECA39
SHA-512:	BC992C742645770AAAA1D3FDC5679295FB37C64FF2276A0A6715F51C50DB51B0D2C70B263437CAB4176B9C6CBF5F235941436AF236F5D2E6E49A156B09EB9172
Malicious:	false
Reputation:	low
Preview:	.[Driver]..Fetched=7/19/2021 11:50:51 AM..date=2012-08-07..version=1.0.0.0..description=ASUS MX279..filehash=69122D35A016ED65B2C48DB81D6E214160EAD841..vendor=ASUS..driver_id=21959131..condition=0..size=5869..build=..result=success..

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\Cache\1FF17A8AE43C05F8C6013F8FA79DE4B60B70971C5_10_64.ini Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	233
Entropy (8bit):	5.2036710563157875
Encrypted:	false
SSDEEP:	6:vWgZHCYIKyTARVKQMooKYe10Vww3dueFRI9PrYX9:pHCYIKlKzoGe10S+duoRQPro
MD5:	E752F33AE770888E6B144FE4192A665D
SHA1:	88F6818590A2CCBAFF33613D6DC9B5A871256F67
SHA-256:	71756800332A51C03C28EC993341908D487FE994C42499AC9882E2390B42335E
SHA-512:	72D5D7EBB2B2D6D94A8EDD7B70938AA7EE609E8A42AD4184ADD501734F16E414E4F4D1BAA8D63802EAF73757F098D0CEA65E92EC9F0FEF1C498C2C64868C73F8
Malicious:	false
Reputation:	low
Preview:	.[Driver]..Fetched=7/19/2021 11:51:13 AM..date=2020-01-16..version=20.10.0.0..description=Pci Bus..filehash=45EB4D4A8E0E227B0DC4B8A4657692FF0D0F2447..vendor=AMD..driver_id=19861291..condition=0..size=47890..build=..result=success..

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\Devices.ini Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	262199
Entropy (8bit):	5.568612175629953
Encrypted:	false
SSDEEP:	1536:E1X1bH1tQYvBL1jT1K1O1e1m1K1B1kY15Y/M1G1p1g1S1p1W1/1O1bYDpO4R1h1+:KQYvB1KpO4yIhIEQYvBtTpO4wIhIn
MD5:	06ED156879ACB8ACCD7DB69C1B0E2308
SHA1:	883B33713C42D5B686AD5EAED712E0D749D238FD
SHA-256:	37C610AFCBAA87AC849582A3693894EFA953794A76BCD37432738DA7256587F8
SHA-512:	6667215F7D6BB136A34DEA9361982C72E4854E3D4CE9E4885A88B183C25BAAE40070E82B4294E715FF7F6D59C5EEA74DBB1641580BA6521AA72CE4777A724DA6
Malicious:	false
Reputation:	low
Preview:	.[Settings]..Program=PC HelpSoft Driver Updater..ProgramCreated=05-31-2021..Generated=07-19-2021..GeneratedTime=11:50:44 AM..Windows=10..x64=1..Version=2..TotalDevices=79..UniqueDevices=71..DuplicateDevices=7..EmptyDevices=1..IgnoreDevices=0..ShouldFoundDevices=71..TimeToGenerate=1953....[Errors]..Dump=0....[Duplicates]..Dump=0....[Empty]..Dump=0..40 7307656=Unknown....[0]..IsConnected=1..IsFailed=0..NeedRestart=0..HasProblem1=0..DevBusDesc=..DeviceDesc=Motherboard resources..DeviceDescRaw=Motherboard resources..ClassName=System..Class=System devices..EnumKey=ACPI\PNP0C02\4..ClassGUID={4D36E97D-E325-11CE-BFC1-08002BE10318}..ClassKey={4D36E97D-E325-11CE-BFC1-08002BE10318}\0044..DriverRank=00FF0002..DriverDate=06-21-2006..DriverDateRaw=38889.0833333333..RegDriverDate=38889.0833333333..DevDriverDate=38889.0833333333..DriverVersion=10.0.17134.1..RegDriverVersion=10.0.17134.1..DevDriverVersion=10.0.17134.1..HardwareIDregular=ACPI\VEN_PNP&DEV_0C02,ACPI\PNP0C02,*PNP0C02..HardwareIDcompat=..

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\DevicesPlus.ini Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	111209
Entropy (8bit):	5.560380564670311
Encrypted:	false
SSDEEP:	1536:c151G1gQYvBD141P1J1d1H1te1cYMM1n101h1y1z181Z1uYupO4R1T1OGr1L1818:mQYvBTpO4tIsII
MD5:	C5AC5E24BD9AD5CD976829FCEF6D9D0E
SHA1:	58370E1725B70C51BDC13E92A1AEB87A16A6B70D
SHA-256:	81BF4A56E391BB064737F3F50E5C474D36E099BAFFE2741442BB52CE7D12DE9A
SHA-512:	6D92739B12943B899807AC98E96C81121F84E7A937070091F8BA40C8D03618C2417FB9B00EB35AAF274C1E02C928F2D862A0B062222EC93C0669200334188737
Malicious:	false
Reputation:	low
Preview:	.[9]..IsConnected=1..IsFailed=0..NeedRestart=0..HasProblem1=0..DevBusDesc=Generic Monitor..DeviceDesc=Generic Non-PnP Monitor..DeviceDescRaw=Generic Non-PnP Monitor..ClassName=Monitor..Class=Monitors..EnumKey=DISPLAY\DEFAULT_MONITOR\4&427137E&0&UID0..ClassGUID={4D36E96E-E325-11CE-BFC1-08002BE10318}..ClassKey={4D36E96E-E325-11CE-BFC1-08002BE10318}\0001..DriverRank=00FF0000..DriverDate=06-21-2006..DriverDateRaw=38889.0833333333..RegDriverDate=38889.0833333333..DevDriverDate=38889.0833333333..DriverVersion=10.0.17134.1..RegDriverVersion=10.0.17134.1..DevDriverVersion=10.0.17134.1..HardwareIDregular=MONITOR\DEFAULT_MONITOR..HardwareIDcompat=*PNP09FF..DeviceID=03CFBAE9C1615BB1E7FC8E1F45A0E381347F3BAE1..ConfigFlags=0..DevProvider=Microsoft..RegProvider=Microsoft..DevManufacturer=(Standard monitor types)..RegManufacturer=(Standard monitor types)..Vendor=MICROSOFT..DevInstallDateRaw=43643.7000075347..InfPath=monitor.inf..InfSection=NonPnPMonitor.Install..DevInstallDate=06-27-2019..DevFirstIn

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\Drivers.7z Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	4479182
Entropy (8bit):	7.999953693647618
Encrypted:	true
SSDEEP:	98304:rsqIY7aWw6yPmQfiY3R7dHYF/wcjcc1xTWqwOQWzV3h:re5OyPVRBU/jjXoqFX
MD5:	6F6D4C6D3C0156F037C1DC6494C68D46
SHA1:	9A76B275104EB2927264C41EA62B17ACA7582113
SHA-256:	6D2C76A7F0F3337DE613783E9DC77EF4503AC8EED7651216FEDABA88D921F8CC
SHA-512:	F4B8DF2994D33E486DF489E607115474330DD391E9FB07BD475BA306AFC1A0B8B3E420F075AA64AD9A07EF05CD174B5185885C89F88DDE46214E83A6DDE97716
Malicious:	false
Reputation:	low
Preview:	7z..'....A3`LXD.....b........Q.m.L7..].).E.`...&d..&.1...!..m....A)..^7]...s.QU..GG&....-#..Ar./.h...e./.R.\|.FZ.......h,.<.e..."..H:......&..\|).M.-.<...wf..w.....W.1;k[..l._....t....F...iU...5^LQ.%<...E.j..o..,...{'..bC...U?.....X.cz.v4.D....2p..[..l"3\|_....j"^.Ayf...+.=..!.R;.,...~...m.e.!.e/.ME3.3J..Wl'..&.3.".G..=..+...)...9...04=A.(...... 7.z.?fK.3....[..Z....>b....M.2.....Cm.x....OF..S....b.R..............G....."9}......$.....J.....$...2>o..y.R..<...U+......8..5,..o...8b..&.(..s]...Q1...,.P...^.q.N..z..J.......[\|.....\.>.\`qG..X7/.....A<T........3;4j.l....%.M..r..}....`.....i.lP.f..#.8.V.D.xkW<..[7....Z..].....[61...).'.x.6...V..S.s.y'=.l..._....{.........".....&f.a.-.h.....,lc.g.D..LbD.........lm....4.E.H.../........h.Y=.{G..%?.....b...../(E9f$...Se...)..........>OUg...w.....6+..8 .w.2.=x.\|.f.!...p.0...D).%k.;... .#...q....)RS.....D.E...//...V.F+.j.y..\|.Y.L.t.c..\|.J(<.]....B..^....-.}.-IwVH9.'a.1@..$u.v$x.e.@..8>O

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\Drivers_ex.db Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	SQLite 3.x database, last written using SQLite version 3007017
Category:	dropped
Size (bytes):	20762624
Entropy (8bit):	4.871659049953048
Encrypted:	false
SSDEEP:	196608:Ivcz8mspU+7MwFKiG6mDj6pgipbT9vdGs7RZSy/xRuowMF+aAUYfDJxpcwv6oQ6i:dWNW+
MD5:	D58F624F1A37E2275D8512F0DD85CB95
SHA1:	95FD2AB8266947115BCC2A26AB88B1210FCA6285
SHA-256:	49369089D3C2D817881BFC14B29891EE4F6976B855F201488DF876E1A946A6B6
SHA-512:	3AC769BDD914A42CDDE818B50C3159986DBE1D271170ADEE4B7FD85954EDAC936AB0B0BAB4BF3122889EE7A22BF1953000310476AF7D68E0700D07BEBB6B29FF
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .4....O4...........@.................................................4...-.)..S........W..."...w.d.....1.......................................................x.......?tabledrivers12drivers12.CREATE TABLE drivers12 (device VARCHAR (100) PRIMARY KEY UNIQUE, date DATE, build BIGINT)1...E...indexsqlite_autoindex_drivers12_1drivers12.x.......?tabledrivers11drivers11.CREATE TABLE drivers11 (device VARCHAR (100) PRIMARY KEY UNIQUE, date DATE, build BIGINT)1...E...indexsqlite_autoindex_drivers11_1drivers11.d........tabledriversdrivers.CREATE TABLE drivers (device VARCHAR (100) PRIMARY KEY UNIQUE, date DATE)-...A...indexsqlite_autoindex_drivers_1drivers.z.......Gtablesettingssettings.CREATE TABLE settings (id INTEGER PRIMARY KEY, name VARCHAR (50) UNIQUE, value VARCHAR (100))/...C...indexsqlite_autoindex_settings_1settings.....Z...%%.ytablesqlite_stat4sqlite_stat4.CREATE TABLE sqlite_stat4(tbl,idx,neq,nlt,ndlt,sample)K...%%.[tablesqlite_stat1sqlite_stat1.CREATE TABLE sq

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\Drivers_new.db Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	data
Category:	dropped
Size (bytes):	8725504
Entropy (8bit):	4.878539106865022
Encrypted:	false
SSDEEP:	24576:oRp2qa48waSHAhHoIvTcxEuafif5zLeh0E+qcuzJJNCyd2sQb8JnSApzkc7JEHaF:YcXfi0LZISp4gVyYjsaV
MD5:	B8F480C1934D8CEC125734AD5FBB9CF7
SHA1:	373948202B6614B26481EE58162AF4CE758CD0D2
SHA-256:	F70EA4C892A476D4EF89A533101F7146AB9A34F790D54560EAB2682B0830B409
SHA-512:	106C060B7457092CAE0000DBF4F504DBC40D51F065BA3BF080F34EBA7F3A2CCB6BC44DEFA9DB6E3FFBE866384D012B7C4DDC7F609BE990A8D630B41339954B53
Malicious:	false
Reputation:	low
Preview:	..S...i....W..."...w.d.....1.i.....................................................x.......?tabledrivers1L...%..eindexhardid_indexdriversO5CREATE INDEX hardid_index on drivers(device)x.......?tabledrivers12drivers12.CREATE TABLE drivers12 (device VARCHAR (100) PRIMARY KEY UNIQUE, date DATE, build BIGINT)1...E...indexsqlite_autoindex_drivers12_1drivers12.x.......?tabledrivers11drivers11.CREATE TABLE drivers11 (device VARCHAR (100) PRIMARY KEY UNIQUE, date DATE, build BIGINT)1...E...indexsqlite_autoindex_drivers11_1drivers11.d........tabledriversdrivers.CREATE TABLE drivers (device VARCHAR (100) PRIMARY KEY UNIQUE, date DATE)-...A...indexsqlite_autoindex_drivers_1drivers.z.......Gtablesettingssettings.CREATE TABLE settings (id INTEGER PRIMARY KEY, name VARCHAR (50) UNIQUE, value VARCHAR (100))/...C...indexsqlite_autoindex_settings_1settings.....Z...%%.ytablesqlite_stat4sqlite_stat4.CREATE TABLE sqlite_stat4(tbl,idx,neq,nlt,ndlt,sample)K...%%.[tablesqlite_stat1sqlite_stat1.CREATE TABLE sq

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\Drivers_new.db-journal Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	data
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	3.5471357158468737
Encrypted:	false
SSDEEP:	24:U8tPboafnP9KnPx4V1DA8nLBNN8+z+t/n:UuPboAFKZ+DlnLBZzM/
MD5:	1F13468CF8F79E1D155FC7E2D0895C54
SHA1:	4718DC4350274177CCCF479428A4AB4B9EEC8BAB
SHA-256:	95C5635494B2C57300069646F2020A83CC55DB6D0A8EDA46B8D25CA5FCCF842C
SHA-512:	44E723E03A45112492DD37DA1DA63A93D3EAF4B56754166EBA7947EA16BBB3640938263878B6B8F5380522A5BC5483F2970FFD2CADE41B5E878572D32FA9322C
Malicious:	false
Reputation:	low
Preview:	...............[..O4................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .4....O4...........@.................................................4...-.)..S........W..."...w.d.....1.......................................................x.......?tabledrivers12drivers12.CREATE TABLE drivers12 (device VARCHAR (100) PRIMARY KEY UNIQUE, date DATE, build BIGINT)1...E...indexsqlite_autoindex_drivers12_1drivers12.x.......?tabledrivers11drivers11.CREATE TABLE drivers11 (device VARCHAR (100) PRIMARY KEY UNIQUE, date DATE, build BIGINT)1...E.

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\Scan.ini Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	5.4981817253040735
Encrypted:	false
SSDEEP:	48:WuHdopGtqTd+TtlDHwSAKMpMtjU/0DoR6STD:WkdopGMdSP74pM9FUv
MD5:	4DD6B6859AF49C5D4A9355C4020F11EC
SHA1:	83D42D0E5038305B6B6B126C1BC916336EEAF2D0
SHA-256:	E6F89F9FD02D62CB06861E4C81703638379EA4E08E1445203080EE34BD22C817
SHA-512:	E0FDBB73A5D9C537A0658D48D3EB1766FF57A1ACC6441AD1182218A0207E2646CEF2ED1ED76CB3BE6FCAAA03E65C3BAD81772302CB658AB33935F7BC2DA8042D
Malicious:	false
Reputation:	low
Preview:	.[Settings]..Program=PC HelpSoft Driver Updater..ProgramCreated=05-31-2021..Generated=07-19-2021..GeneratedTime=11:50:46 AM..GeneratedRaw=44396.4935962616..PC=DADD2726C9E27C250E78DE5F811CA6B6..Windows=10..x64=1..Version=1..BaseNew=2021-06-16..TimeToGenerate=31250....[Errors]..Dump=0....[1]..DeviceName=Generic Non-PnP Monitor..FName=69122D35A016ED65B2C48DB81D6E214160EAD841.7z..PackageName=69122D35A016ED65B2C48DB81D6E214160EAD841.7z..AltFName=69122D35A016ED65B2C48DB81D6E214160EAD841.7z..Date1=06-21-2006..Date1Raw=38889.0833333333..Date2=08-07-2012..Vendor=ASUS..Version1=10.0.17134.1..Version2=1.0.0.0..Installer=..Description=..DeviceDescription=ASUS MX279..Class=Monitors..ClassName=Monitor..ClassGUID={4D36E96E-E325-11CE-BFC1-08002BE10318}..InfPath=monitor.inf..InfSection=NonPnPMonitor.Install..IsConnected=1..IsFailed=0..HardId=MONITOR\\DEFAULT_MONITOR..HardIdRaw=MONITOR\DEFAULT_MONITOR..Md5Hash=69122D35A016ED65B2C48DB81D6E214160EAD841..FullHID=1..DeviceIniSection=9..EnumKey=DISPLAY\DEF

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\program.log Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	modified
Size (bytes):	2470
Entropy (8bit):	5.367809132468249
Encrypted:	false
SSDEEP:	24:Wb92nHqAMbqt9UUJ7HETVugWBoZlcVmG05khMos4cx9TshCr101qh1vQI1d1tC1e:CIHfMbiq27HET8gaoPimT5khuCJ8tMk
MD5:	3F198D0AA2747D6C89EF7CBD96867CCC
SHA1:	E491B2F7AA02070EB0C3D8C4EFF17DC0E341C803
SHA-256:	3686B15E83986AEDB79D90F22D33D5850708CE5985032AF495CE8E843BC53139
SHA-512:	345F3DC88380AA4D1CDA616CA00CA67FCBD683E053528AA926226315950659F550FEB181F1C0C4CDCDDA6F197E27B7E8F22DF7BF0056F2274A8E3C4029E5995B
Malicious:	false
Reputation:	low
Preview:	.11:50:20 AM : -----PROGRAM STARTED 31-05-2021 19-42 104_64 ----- PARAMS: 7/19/2021 11:50:20 AM..11:50:20 AM : Setup PARAMS: PC HelpSoft Labs Inc..11:50:20 AM : CheckInstallationAfterReboot PARAMS: begin..11:50:20 AM : Program not registered..11:50:28 AM : OpenHidden PARAMS: posti_before=mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALL..11:50:28 AM : OpenHidden PARAMS: posti_after=mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALL..11:50:29 AM : TForm1a.Panel1Button1Click PARAMS: begin..11:50:29 AM : PNR..11:50:29 AM : TfrmMain.FormCreate PARAMS: begin..11:50:29 AM : UpdateDriverBases PARAMS: No database: Update requires %userpath%\AppData\Roaming\PC HelpSoft Driver Updater\Drivers_new.db..11:50:29 AM : UpdateDriverBases PARAMS: Update requires..11:50:29 AM : InitAndScanResultFrame PARAMS: Updating..11:50:29 AM : TUpdateThread.DownloadDataBase PARAMS: Url=/10_64.json..11:50:30 AM : DownloadDataBase PARAMS: Result: {"ok":1,"date":"2021-06-16","url":"http:\/\/rece

C:\Users\user\AppData\Roaming\PC HelpSoft Driver Updater\settings.ini Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.357295873840569
Encrypted:	false
SSDEEP:	3:VRgKPZBan:VOyDa
MD5:	299198D7320F39FF5B64AFD6E0255A54
SHA1:	BCF331F7B2CA7E73D9CCEA71B7C52C7FF7D62455
SHA-256:	84E06FE309B5A81E0BFC8B4D624640ADD57D07593957937DC54E6185853AF575
SHA-512:	5C9401E973A8DD044402BC93233E941184CDAED4E21327137FF94BC11313BF6CA989F6BA31E4BCC71C6D445BD8CF5B96B84A5B673AFE06251D1BE0BA7377F38F
Malicious:	false
Reputation:	low
Preview:	[general]..LastUpdate=7/19/2021....

C:\Users\user\Desktop\cmdline.out Download File
Process:	C:\Windows\SysWOW64\wget.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	10153
Entropy (8bit):	2.6547626084779106
Encrypted:	false
SSDEEP:	48:ggqYQqkqFE361bqVxZM/W6J2m7vMWT6YNpLMxDq2lOHMbVgeoGpST73Y4b/SKbqk:ggqRqkq+nj6J2evx6WpgRqpMvK3Y4bak
MD5:	E9A3E1D917ABBD9E75E1887E7B3C9671
SHA1:	55AD4AA5BB443ECA77E6A5C5C309A9EDC5C37034
SHA-256:	0F4665EE540F8ED8039D043B5D70C650FA131501C023E4078D9482FADF84B02D
SHA-512:	C9059F0DCCB85FD4B031C7073A5143C611B3C860E151BEFE1FC6F79880898753B544CC44F3F66EEA97161DA62B464BE997A5B198F153CE51F2B9BE24FDD8CF04
Malicious:	false
Reputation:	low
Preview:	--2021-07-19 11:49:50-- https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe..Resolving webtools.avanquest.com (webtools.avanquest.com)... 217.195.25.241..Connecting to webtools.avanquest.com (webtools.avanquest.com)\|217.195.25.241\|:443... connected...HTTP request sent, awaiting response... 302 Found..Location: https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe [following]..--2021-07-19 11:49:51-- https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe..Resolving cdn.pchelpsoft.com (cdn.pchelpsoft.com)... 13.225.74.90, 13.225.74.49, 13.225.74.66, .....Connecting to cdn.pchelpsoft.com (cdn.pchelpsoft.com)\|13.225.74.90\|:443... connected...HTTP request sent, awaiting response... 200 OK..Length: 6052448 (5.8M) [application/x-msdownload]..Saving to: 'C:/Users/user/Desktop/download/Driver_Updater.exe'.... 0K .......... .......... .......... .......... .......... 0% 539K 11s.. 50K .......... .......... .......... ..........

C:\Users\user\Desktop\download\Driver_Updater.exe Download File
Process:	C:\Windows\SysWOW64\wget.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6052448
Entropy (8bit):	7.943720804239193
Encrypted:	false
SSDEEP:	98304:X1QTPJnFCARiitPPul5X91Xvv7Ehe4CQGEcuBNt6Cftgs9udeWA2F:lQCA9PuPXnV4CxDuR6qqeWA2F
MD5:	E0B9B386B29E117110318302CE973889
SHA1:	713F85D56B8CB57C82194731D886241AE46C6219
SHA-256:	07F1766F4C627994FB27CA2A327DEEC51C404BFA64A9B28A868C26621568DFE4
SHA-512:	332AF5E9CB7D1F87135B8E6B42A54BED302CC2063D1CF4CF809F090EEDFBDFEB0DD3A642B58FA83F5E899BB7FCD9F0AD89085A26F917DE459A8430EE7F310466
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....].................j...........~............@.................................Pd\...@......@...................`.......@...........F...........3\.X'...........................................................B..@....P.......................text....P.......R.................. ..`.itext..h....p.......V.............. ..`.data....7.......8...n..............@....bss....xg...............................idata.......@......................@....didata......P......................@....edata.......`......................@..@.tls.........p...........................rdata..]...........................@..@.rsrc....F.......F..................@..@....................................@..@........................................................

C:\Windows\INF\c_monitor.PNF Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	data
Category:	dropped
Size (bytes):	6852
Entropy (8bit):	3.325773981835646
Encrypted:	false
SSDEEP:	96:tP294tAXIc2fWOMnVj3yANMGUYcRNqE9O8tU6Efv3VZNNJx:nbfn2j3vxUrD86WjNn
MD5:	4F65E13D0B8DD6DE616E9CE4167553EA
SHA1:	452919F99444F90F22BC52D07C1842518A6C5E0B
SHA-256:	9F9E09D040653580ECF97D0E5AAF4447F930FA73C48607B72B5A58503B8980D6
SHA-512:	7FFB77544F7B99F5EC99CEE7EF53BFF87C727E27E3CFCB5F105F325B376B57F71E1CE81BBFCF8C9B29DA78D7CDC6BCEC21FACE329946FD17B0453CC76793E3B8
Malicious:	false
Reputation:	low
Preview:	........................*.N.....u>.>.......d.......................P...4.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......d...................l.......4.......................................................................\...........................................................................4...........`...................................................................$...........................................................................................................,...............................................................................................................................................................................................................T...........................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_processor.PNF Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	data
Category:	dropped
Size (bytes):	5356
Entropy (8bit):	3.067204974637415
Encrypted:	false
SSDEEP:	96:KjRG+gmXfWAAeSpuZ7iOptNUqmyEc8Vze8SWtpJO1:qXXfJAzpIzUq7Ec8ReBWlc
MD5:	C9A0E7E4AF93265B3CAFD44ADFBC58A8
SHA1:	FC54FF467FD675BD926E758475F46E5C463728DC
SHA-256:	327DF04490F00BD8FC11A1BE17B139985EBFAE9C289DD34B38A28192C99C4E3B
SHA-512:	52A22BE01453190D15DB628FAC3A2E5D41EC517D578625A6AC301205C29FE8B404C23D4F1B210069CB552509F6DDBCCCCE37658162CB109A2C48ECA2139D5819
Malicious:	false
Reputation:	low
Preview:	.........................,Q......Y9.>.......................0.......8...T.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t...................\|.......D.......................................................................h...............................................................................................................................................................................................................................................................\|.......8...............................D...................................T.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_volume.PNF Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	data
Category:	dropped
Size (bytes):	4548
Entropy (8bit):	2.8261792652207327
Encrypted:	false
SSDEEP:	48:+XCCGz7ElZd/Wykc5KaMRi4Y7eaIDbsRbXKVMRGGLp7tVCCHr6mv7C:QhGzY/Wy+YBusNXDLpxV3r6mvG
MD5:	07C8A2574CA8B6ACE31CB40EF3CA3746
SHA1:	011DD237CB44753C6A52BD951CFFFCD3006B08F4
SHA-256:	180B208072ABB63C2C06B256F285AB80FB40A2926D7FAD1DBD772E9F5C2ED9FC
SHA-512:	25C79BFCF57CA728F33F92F7DC3502D0D2FBC376AD69D1F5B8FEF3BD17B8B79A2D321D51EA44637C05D193AA537E9EDD383A94F9395B9143E47E7501BA2A74AB
Malicious:	false
Reputation:	low
Preview:	..........................S......;.>...................d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...........................H.......................................................................p...............................................................\|.......................................................................................................................................................................................................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\vhdmp.PNF Download File
Process:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
File Type:	data
Category:	dropped
Size (bytes):	7788
Entropy (8bit):	3.494310554167017
Encrypted:	false
SSDEEP:	96:wGBXjou7h0FXWNfxOT31i3mCNokTnpBgFwV1ID6KRGnhGhdHwrXJSyEPSYWy6K3A:wGhHfYU3mMLTno2rKYnWwrg0PDnnaYYe
MD5:	AF290BE5665F972871A4FDD2A04EE7F8
SHA1:	41E0E5830CF4AAF26BA6849E6DF185B2EE3E6B04
SHA-256:	AC3DCAB2F99B02F1872C60C7DA66D1A1C1C5CDCF873EE34FDE68D6D30E17A967
SHA-512:	898852013D8A481CE1E4C2CEADC28624081E4131DB52532B7001990904903962285109FBABC508039C7A3DA488C81B9FE66D43AE25F95A90467B57C187DB0C0C
Malicious:	false
Reputation:	low
Preview:	................ ...0...o........J.>...............P.......h.......H.......X...h...............h.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................................................................................................................................<.......X...........................................T.......................8.......................................................8.......................................................$...............................................\|...............................D...........................$...............p...........................................................................$.......................L...................................................................................L...............................................................................................................................................................................................D...........l...........................

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 19, 2021 11:49:50.642266989 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:50.696679115 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:50.696888924 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:50.703418016 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:50.755799055 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:50.756582975 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:50.756628990 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:50.756659031 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:50.756740093 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:50.763761997 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:50.821253061 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:50.825411081 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:50.920684099 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:50.937427044 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:50.978959084 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:51.046114922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.088783026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.088891983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.091677904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.134857893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.137540102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.137578964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.137617111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.137785912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.141233921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.141405106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.144244909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.186583996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.186707020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.188535929 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.230993032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.233587027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.233663082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.233685970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.233712912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.233773947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.233838081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.234997034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.235147953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.235153913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.236092091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.236120939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.236238003 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.237293959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.237325907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.237427950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.238542080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.238569975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.238687992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.239684105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.239708900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.239785910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.240876913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.240927935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.241008043 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.242055893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.242085934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.242192984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.243273020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.243308067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.243381977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.244458914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.244487047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.245089054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.245466948 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:51.245716095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.245740891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.245862007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.246941090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.246982098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.247097015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.248128891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.248162985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.248254061 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.249536037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.249659061 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.267890930 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:51.276346922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.276381969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.276402950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.276488066 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.277494907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.277523041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.277601957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.278714895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.278739929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.278815985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.279913902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.279939890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.280016899 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.281100035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.281126022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.281193972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.282339096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.282365084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.282455921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.283499956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.283526897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.283652067 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.284729004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.284754992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.284828901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.285873890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.285892010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.285964012 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.287046909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.287085056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.287142992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.288243055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.288259029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.288388014 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.289524078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.289541006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.289742947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.290637016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.290673018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.290760994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.291872978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.291951895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.291963100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.293010950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.293030977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.293149948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.294233084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.294265985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.294367075 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.295447111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.295469046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.295572042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.296603918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.296623945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.296736956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.297380924 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:51.297395945 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:51.297404051 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:51.297589064 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:51.297640085 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:51.297844887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.297863007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.297935009 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.299104929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.299137115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.299194098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.300225973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.300246000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.300390959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.301436901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.301455975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.301529884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.302584887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.302603006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.302671909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.318784952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.318819046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.318912029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.319205999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.319232941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.319288969 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.319960117 CEST	443	49733	217.195.25.241	192.168.2.4
Jul 19, 2021 11:49:51.320063114 CEST	49733	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:49:51.321042061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.321069956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.321204901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.321510077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.321535110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.321621895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.323412895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.323446989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.323555946 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.324713945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.324752092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.324837923 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.325921059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.325967073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.326054096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.327104092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.327178001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.327212095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.328192949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.328283072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.328293085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.328613997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.328638077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.328696966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.330493927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.330554962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.330605030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.330935955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.330961943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.331020117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.331995010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.332016945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.332104921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.332870007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.332891941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.332990885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.335427046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.335493088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.335531950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.335864067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.335897923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.335936069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.337745905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.337774992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.337842941 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.349286079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.392462015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.392510891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.392549038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.392688036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.392792940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.392837048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.392874956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.392887115 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.392941952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.393729925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.393779993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.393822908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.393867970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.394639015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.394681931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.394718885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.394726038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.394768000 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.395595074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.395631075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.395649910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.395728111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.396725893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.396770000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.396806955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.396822929 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.396868944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.396934986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.397425890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.397741079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.397784948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.397824049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.397881031 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.397906065 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.398701906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.398756981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.398793936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.398842096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.399589062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.399631023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.399669886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.399682999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.399754047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.400473118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.400513887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.400551081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.400610924 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.401438951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.401484966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.401523113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.401529074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.401588917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.402343988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.402385950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.402424097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.402452946 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.403157949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.403230906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.403274059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.403311014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.403317928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.403372049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.404230118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.404268980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.404300928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.404345036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.405195951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.405256033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.405277014 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.405283928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.405359983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.406069040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.406119108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.406148911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.406172991 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.406972885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.407011986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.407073975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.407119989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.407157898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.407871008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.407908916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.407942057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.407984972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.408804893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.408837080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.408873081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.408902884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.408937931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.409740925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.409796953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.409840107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.409869909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.410672903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.410734892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.410769939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.410784006 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.410845995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.411603928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.411664009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.411710024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.411735058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.412517071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.412585020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.412586927 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.412630081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.412702084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.413454056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.413491011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.413546085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.413611889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.414330959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.414356947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.414380074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.414411068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.414437056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.425308943 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.436754942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.436800003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.436886072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.436920881 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.436927080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.436964035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.437005997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.437844038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.437885046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.437925100 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.437926054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.438009977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.439034939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.439106941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.439189911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.439217091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.439660072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.439693928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.439754963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.440375090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.440416098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.440450907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.440454006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.440531015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.440944910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.440984964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.441024065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.441049099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.443233967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.443270922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.443316936 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.445955992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.445997953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.446027040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.446106911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.446204901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.446345091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.446465969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.446513891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.446552038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.447305918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.447346926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.447382927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.447386980 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.447455883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.448256969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.448328018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.448374987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.448467970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.449194908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.449284077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.449285984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.449335098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.449412107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.450088024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.450128078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.450237036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.467664003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.467700005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.467726946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.467883110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.467982054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.468007088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.468031883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.468135118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.468913078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.468944073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.468969107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.469049931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.469816923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.469876051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.469914913 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.469953060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.470016956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.470185041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.470680952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.470702887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.470721006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.470765114 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.471596956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.471615076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.471630096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.471663952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.471692085 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.472496033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.472515106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.472531080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.472614050 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.473357916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.473373890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.473386049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.473442078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.473469019 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.474271059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.474292994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.474309921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.474457026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.475234985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.475286961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.475339890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.475346088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.475435019 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.476063967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.476093054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.476115942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.476202011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.476974010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.476996899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.477021933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.477068901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.477145910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.477849960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.477876902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.477900028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.477999926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.478796959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.478822947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.478899956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.478903055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.479032040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.479628086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.479650974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.479671955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.479770899 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.480534077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.480559111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.480577946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.480645895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.480712891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.481406927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.481426954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.481446028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.481538057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.482362986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.482389927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.482410908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.482475042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.482563019 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.482939959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.482964039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.482984066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.483002901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.483059883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.483128071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.483830929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.483885050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.483915091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.483978033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.483999014 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.484091997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.484581947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.484603882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.484628916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.484649897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.484730959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.485375881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.485402107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.485425949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.485451937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.485483885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.485527992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.486176014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.486208916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.486287117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.486582041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.486608982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.486634970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.486660004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.486675024 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.486706018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.487396002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.487425089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.487449884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.487483025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.487530947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.487559080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.488260031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.488286018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.488317013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.488344908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.488367081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.488389015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.489005089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.489031076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.489056110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.489080906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.489082098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.489121914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.489835024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.489865065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.489891052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.489923000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.489950895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.489995003 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.490658045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.490688086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.490712881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.490741014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.490753889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.490787983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.491487980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.491525888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.491564035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.491590023 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.491596937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.491652966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.492438078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.492480040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.492516041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.492532969 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.492578983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.492631912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.493135929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.493176937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.493217945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.493231058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.493256092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.493304968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.493927002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.493953943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.493979931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.494009972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.494020939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.494069099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.494756937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.494786978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.494812965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.494852066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.494874954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.494925976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.510216951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.510261059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.510370016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.510940075 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.512360096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.512403965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.512433052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.512499094 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.512610912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.512650013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.512686014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.512686014 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.512722015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.512792110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.513365030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.513405085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.513439894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.513462067 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.513485909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.513499975 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.513971090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.514214993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.514264107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.514286995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.514306068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.514342070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.514354944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.514978886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.515017986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.515053034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.515054941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.515093088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.515116930 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.515783072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.515825033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.515856028 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.515862942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.515913963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.515928030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.516568899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.516607046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.516645908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.516655922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.516684055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.516707897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.517388105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.517426968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.517477989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.517543077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.517568111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.517601967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.518307924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.518456936 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.518524885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.518636942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.518692970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.518724918 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.519062042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.519135952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.519155025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.519181967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.519217968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.519238949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.519829988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.519870043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.519893885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.519905090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.519953012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.519968033 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.520675898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.520718098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.520754099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.520760059 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.520792007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.520812035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.522898912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.522969007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.523015022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.553414106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553447008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553463936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553486109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553505898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553527117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553539038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.553553104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553570032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.553575993 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.553576946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553600073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553615093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.553622007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.553656101 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.554265022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.554328918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.554347038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.554361105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.554383993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.554406881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.554429054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.554430008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.554450989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.554461002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.554506063 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.555243015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.555269957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.555293083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.555314064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.555337906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.555356026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.555361986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.555388927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.555402994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.555459976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.556083918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556113005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556138039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556185007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.556236029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.556415081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556449890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556483030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556505919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556529045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556549072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556571960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.556582928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.556611061 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.556616068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.557358027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.557395935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.557420015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.557439089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.557450056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.557455063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.557471991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.557486057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.557574987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.557605982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.558350086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.558378935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.558408976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.558433056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.558458090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.558480978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.558491945 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.558505058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.558568954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.558587074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.559165955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559189081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559201002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559269905 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.559324026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.559530973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559556961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559581995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559592962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559604883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559616089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559627056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.559674025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.559741974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.560440063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.560466051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.560486078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.560507059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.560527086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.560533047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.560547113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.560601950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.560609102 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.560699940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.560782909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.561333895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.561368942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.561394930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.561412096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.561429977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.561451912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.561475039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.561542034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.561626911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.562148094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562165976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562202930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562212944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.562258005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.562552929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562587976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562608004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562628031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562647104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562654972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.562666893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562670946 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.562691927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562715054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.562728882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.562793970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.563549042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.563589096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.563615084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.563632011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.563649893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.563673019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.563678026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.563689947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.563699007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.563710928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.563757896 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.563795090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.564522028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.564551115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.564579010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.564596891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.564614058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.564619064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.564635992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.564649105 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.564656019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.564675093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.564701080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.564734936 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.565520048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.565548897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.565572023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.565592051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.565606117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.565613031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.565634012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.565645933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.565654993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.565685987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.565721035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.565772057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.566490889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.566519022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.566540003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.566560984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.566570997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.566581011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.566597939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.566617966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.566634893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.566648960 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.566673994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.566710949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.567389011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.567426920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.567449093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.567471027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.567492962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.567498922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.567516088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.567521095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.567540884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.567563057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.567570925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.567620993 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.568300009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.568319082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.568336964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.568351984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.568387985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.568393946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.568432093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.568456888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.568478107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.568495989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.568511963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.568553925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.569252014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.569295883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.569312096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.569330931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.569350004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.569365025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.569372892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.569386005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.569394112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.569416046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.569477081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.569490910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.570276022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.570302010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.570323944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.570368052 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.570382118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.570403099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.570436001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.570447922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.570472956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.570517063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.570537090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.570575953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.571239948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.571289062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.571305990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.571321964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.571352005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.571355104 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.571366072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.571393967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.571399927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.571424961 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.571433067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.571479082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.572240114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.572280884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.572321892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.572346926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.572360992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.572391987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.572412968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.572418928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.572448969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.572458029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.572477102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.572530985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.573168039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.573230028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.573260069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.573283911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.573286057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.573314905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.573335886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.573364973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.573390961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.573417902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.573420048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.573523998 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.574078083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.574147940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.574203968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.574215889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.574242115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.574279070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.574287891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.574322939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.574362040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.574366093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.574399948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.574460030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.575146914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.575233936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.575285912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.575299978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.575336933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.575387001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.575392008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.575442076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.575490952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.575498104 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.575565100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.575632095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.576078892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.576148987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.576204062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.576204062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.576272964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.576316118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.576323032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.576371908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.576411963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.576420069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.576473951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.576514959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.577138901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577193975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577234983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.577249050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577300072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577339888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.577347040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577394962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577430964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.577442884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577488899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577526093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.577857971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577938080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.577980995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.577986002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.578114033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.578155994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.578169107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.578217030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.578258038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.578265905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.578316927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.578356028 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.578867912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.578917980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.578954935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.578967094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579015017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579050064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.579060078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579190016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579243898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579263926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.579293966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579363108 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.579839945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579890966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579940081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.579952955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.579988003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580034971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580039978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.580081940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580132961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580153942 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.580183983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580245018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.580743074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580820084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580874920 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.580892086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580946922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.580996990 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.580996990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581043005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581089020 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.581090927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581140995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581196070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.581769943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581819057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581867933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581872940 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.581918001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581967115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.581968069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.582015038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582060099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.582062006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582108021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582165003 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.582691908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582741976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582788944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582794905 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.582835913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582881927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582886934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.582936049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.582986116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.582987070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583034992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583082914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.583636999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583693027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583741903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583750010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.583790064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583836079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583838940 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.583888054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583934069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.583939075 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.583981037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.584032059 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.595789909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.595833063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.595873117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.595901966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.595907927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.595973969 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.620141983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.631093025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.662807941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.662878036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.662930965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.662956953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.662986040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663033962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663039923 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.663078070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663144112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663153887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.663198948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663238049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663264036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.663295031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663343906 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.663351059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663410902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663455009 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.663461924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663503885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663556099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.663615942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663677931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663724899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663744926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.663764000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663801908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663816929 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.663882017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.663938999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.664129019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664200068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664248943 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.664252996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664308071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664359093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.664361954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664424896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664469957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.664482117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664541960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664586067 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.664594889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664637089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664674044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664688110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.664711952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664750099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664757967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.664784908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664823055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664840937 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.664937973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664980888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.664997101 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665035963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665081024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665086031 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665117979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665158987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665163994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665198088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665251017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665260077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665395975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665447950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665467978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665505886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665555000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665566921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665592909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665628910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665632963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665666103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665703058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665707111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665740013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665785074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665785074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665827036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665863037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665875912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665900946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665937901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.665940046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.665972948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666008949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666013002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.666044950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666084051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.666090012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666131020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666168928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666176081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.666205883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666253090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.666280985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666354895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666407108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666445017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666454077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.666497946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666506052 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.666553974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666600943 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.666614056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666759968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666824102 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.666893005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666933060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.666980028 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667049885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667090893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667144060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667179108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667218924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667265892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667273045 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667309046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667346001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667359114 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667382956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667421103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667426109 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667455912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667494059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667503119 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667531967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667584896 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667689085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667803049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667854071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667862892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667906046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667952061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.667958975 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.667994022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668030977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668044090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668070078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668107033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668116093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668143988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668180943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668203115 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668216944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668263912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668267965 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668303967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668339968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668348074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668378115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668414116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668426037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668450117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668487072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668500900 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668524027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668570995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668622971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668661118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668740034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668759108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668812990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668869019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668884993 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.668920994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.668971062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669023991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669035912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.669074059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669085026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.669150114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669203997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.669209003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669265985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669329882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669349909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.669572115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669636011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669640064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.669691086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669749022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669759989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.669807911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.669863939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.670098066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670162916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670213938 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670216084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.670270920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670392036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670497894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.670548916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670610905 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.670614004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670658112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670703888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670706987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.670743942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670787096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670789957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.670840979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670897007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.670898914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670942068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670979977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.670989037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671015978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671070099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671073914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671168089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671219110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671225071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671279907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671365976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671413898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671514034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671570063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671576023 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671612978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671652079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671667099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671690941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671727896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671737909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671775103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671816111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671828985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671853065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671890974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671897888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.671927929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671963930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.671974897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672000885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672039032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672049046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672117949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672169924 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672271013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672327995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672365904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672379017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672401905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672440052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672446966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672477007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672521114 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672523022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672581911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672629118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672633886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672682047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672724009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672741890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672854900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672904968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.672914982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.672956944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673036098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673043966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673254013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673312902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673351049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673369884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673417091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673448086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673459053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673496008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673499107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673532963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673569918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673576117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673607111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673645020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673646927 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673681974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673718929 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673727989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673769951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673805952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673815012 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673845053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673882961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673894882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673921108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673958063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.673966885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.673995018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674041033 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674046993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674140930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674190044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674247026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674285889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674323082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674340963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674369097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674411058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674417019 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674448013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674484968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674499035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674523115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674557924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674575090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674595118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674633026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674640894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674679041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674721003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674729109 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674757004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674803972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.674822092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674937010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.674995899 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675020933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675059080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675133944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675143957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675235987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675252914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675270081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675285101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675302029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675316095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675321102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675338984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675359011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675365925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675374031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675374985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675395966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675414085 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675417900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675431013 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675440073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675460100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675473928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675482035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675498962 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675504923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675527096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675554037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675565004 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675580025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675601006 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675601959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675626040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675646067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675662041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675667048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675678015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675695896 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675721884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675825119 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675863028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675885916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675909042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.675930977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675965071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675985098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.675983906 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676008940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676026106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676029921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676043034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676063061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676074028 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676079988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676095963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676111937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676114082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676129103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676143885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676147938 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676160097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676182032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676201105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676214933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676804066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676855087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676863909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676875114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676901102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676917076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676927090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676933050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676949024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676965952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676969051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.676981926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.676986933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677004099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677020073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677035093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677045107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677051067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677067995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677097082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677114964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677578926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677602053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677632093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677681923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677711964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677726030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677737951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677768946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677781105 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677795887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677819967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677835941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677849054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677850962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677866936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677882910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677884102 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677901983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677918911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677918911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.677933931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677951097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677973986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.677980900 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678010941 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678035021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678529978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678560972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678591967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678621054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678633928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678651094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678673029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678674936 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678699017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678719044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678725004 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678735971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678760052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678776026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678781033 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678792953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678802967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678809881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678824902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678841114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678842068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678858042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678868055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.678877115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.678901911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.679505110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679534912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679563046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679563999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.679593086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679617882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.679620028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679652929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679661989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.679680109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679696083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679711103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679727077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679733038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.679743052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679758072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.679763079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679780960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679785013 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.679795980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.679836988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680304050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680327892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680355072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680375099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680381060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680392027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680407047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680423021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680453062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680459023 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680469990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680494070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680501938 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680510044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680525064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680537939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680541039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680557013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680576086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680582047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680593967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680609941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680609941 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680625916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.680644989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.680689096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.681266069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681294918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681318045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681344032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681356907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.681370974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681386948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681399107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.681412935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681430101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681435108 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.681444883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681464911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681482077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681485891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.681499004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681513071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.681516886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681534052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681550026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681566000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681581020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.681622982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.681655884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.681662083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.682250977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682276964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682302952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682315111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.682328939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682356119 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682360888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.682375908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682393074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682408094 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.682409048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682429075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682447910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682460070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682471991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682483912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682499886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.682542086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.682581902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.682586908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683034897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683067083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683094025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683130026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683140993 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683161020 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683166981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683197021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683214903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683221102 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683231115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683245897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683262110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683270931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683278084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683295012 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683295965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683310032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683326006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683342934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683358908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683363914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683379889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683399916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683434010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.683974981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.683996916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684024096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684039116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684045076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.684066057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684091091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684092045 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.684120893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684137106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.684153080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684170961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684186935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684197903 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.684202909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684218884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684227943 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.684238911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684256077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684262991 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.684271097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684287071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684298992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.684303999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684331894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.684978962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.684995890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685018063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685028076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685034037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685061932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685064077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685086012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685100079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685101032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685117006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685133934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685142040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685153008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685170889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685180902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685185909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685203075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685216904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685218096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685262918 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685748100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685771942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685790062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685794115 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685811996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685827017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685842991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685868025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685882092 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685885906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685908079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685921907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685926914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685937881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685951948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685964108 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.685966969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685985088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.685996056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686001062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686016083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686031103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686033964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686045885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686059952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686096907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686726093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686747074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686774015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686790943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686811924 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686817884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686835051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686841965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686856985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686882973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686886072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686901093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686919928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686925888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686934948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686949968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686961889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.686964989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686980009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.686995029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687002897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687012911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687030077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687033892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687057018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687699080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687716007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687736988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687753916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687764883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687778950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687803030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687805891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687825918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687829971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687840939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687855005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687865973 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687874079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687891006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687903881 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687906027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687921047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687926054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.687932968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.687973976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688497066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688514948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688539028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688555956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688561916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688577890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688585997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688600063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688615084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688623905 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688638926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688658953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688662052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688676119 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688690901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688703060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688705921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688724995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688734055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688740969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688755989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688771009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688771009 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688786030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.688792944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.688831091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.689449072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689476967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689493895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689517975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689524889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.689533949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689548969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689564943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689573050 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.689591885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689593077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.689611912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689627886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689651966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689665079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689677000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689682007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.689687967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689702988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689722061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689737082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.689737082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.689766884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.718750954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.718822956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.718868017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.718919039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.718950987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.718955040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719089031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719167948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719207048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719249964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719293118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719305038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719331026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719364882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719399929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719408035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719434023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719465971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719466925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719501019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719517946 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719533920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719578028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719599962 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719615936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719650030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719666958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719686031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719721079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719739914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719754934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719789982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719810963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719824076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.719912052 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.719932079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720052004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720089912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720112085 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720125914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720161915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720177889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720204115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720242023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720261097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720277071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720312119 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720330000 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720346928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720380068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720398903 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720415115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720448017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720478058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720490932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720529079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720551014 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720561028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720596075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720617056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720634937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720671892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720705986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720716000 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720738888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720779896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720793009 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720858097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.720858097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.720987082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721024990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721045017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721067905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721107960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721128941 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721144915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721180916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721204042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721216917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721250057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721271992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721285105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721334934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721359968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721371889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721394062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721430063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721463919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721489906 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721498013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721499920 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721532106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721657991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721695900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721730947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721806049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721837044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721844912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.721879959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721914053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721956015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.721995115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722008944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.722059965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722114086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722170115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722222090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722264051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.722276926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722321987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.722332001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.722333908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722393990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722393990 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.722450972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722501040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722542048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.722556114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722661972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.722768068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722861052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722920895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.722943068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.722994089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723041058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723082066 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.723092079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723162889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.723200083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723253012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723299026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723345995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.723355055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723409891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723449945 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.723465919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723520041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723582029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723598003 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.723644018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.723731041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723790884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723835945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723870039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.723884106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723927975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.723937988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.723978043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724025011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.724025965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724070072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724114895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724114895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.724160910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724205017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724214077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.724250078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724294901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724314928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.724374056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724437952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.724484921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724580050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724627018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724644899 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.724670887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724714994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724761009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724773884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.724812984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.724828005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724875927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724926949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.724977016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725009918 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.725022078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725027084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.725064993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725115061 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.725117922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725167036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725210905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725254059 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.725256920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725301027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725306988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.725342989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725390911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.725392103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725445032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.725519896 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.928212881 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.970544100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970573902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970594883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970694065 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.970736027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970758915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970779896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970793962 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.970799923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970823050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970838070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.970846891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970859051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.970870018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970890045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970911026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970915079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.970932007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.970967054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.970971107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971003056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971018076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971024990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971045971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971067905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971069098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971088886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971110106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971112013 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971178055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971220970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971225023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971260071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971278906 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971297026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971340895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971345901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971384048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971416950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971427917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971437931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971470118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971494913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971527100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971549034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971570015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971590996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971612930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971622944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971642017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971666098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971685886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971707106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971729040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971731901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971749067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971771002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971791983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971807957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971816063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971838951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971858978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971865892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971879959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971900940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971920967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971946001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.971957922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.971978903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972002983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972026110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972037077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972045898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972076893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972084045 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972107887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972109079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972141981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972158909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972176075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972209930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972234011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972248077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972290039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972291946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972330093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972353935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972364902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972377062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972397089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972412109 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972418070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972438097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972457886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972457886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972479105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972493887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972498894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972522020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972536087 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972543955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972564936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972582102 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972585917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972606897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972626925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972628117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972649097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972667933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972668886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972693920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972706079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972902060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972927094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972940922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.972966909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.972989082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973006964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973028898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973063946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973064899 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973103046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973136902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973140001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973185062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973216057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973228931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973248005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973268032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973289967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973301888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973318100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973335981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973359108 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973372936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973392963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973400116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973413944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973433971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973442078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973458052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973479033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973481894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973500013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973521948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973525047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973542929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973562002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973562956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973596096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973638058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.973920107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973943949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973977089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.973989010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974010944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974042892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974046946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974083900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974095106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974116087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974144936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974165916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974169970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974189997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974211931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974220037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974231005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974251986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974262953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974272013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974292040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974303007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974313974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974334002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974356890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974379063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974380016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974387884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974401951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974425077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974442005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974473953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974529982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974760056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974809885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974817038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974841118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974862099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974896908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974898100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974919081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974951029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974965096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.974972010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.974992990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975013018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975028992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975058079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975069046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975078106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975104094 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975106001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975162029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975183964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975204945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975213051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975227118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975249052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975251913 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975270987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975292921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975312948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975337029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975337982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975359917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975369930 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975373983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975378990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975399971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975416899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975439072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975574017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975707054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975748062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975768089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975780964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975815058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975855112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975863934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975876093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975893021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975919962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975940943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975960970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975970984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.975982904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.975999117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976003885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976025105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976044893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976056099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976064920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976084948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976089954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976113081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976128101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976150036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976157904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976171970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976180077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976195097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976217031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976219893 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976238012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976280928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976511002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976531982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976553917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976562977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976593018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976604939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976615906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976650953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976656914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976696014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976730108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976731062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976766109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976794958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976811886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976828098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976849079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976866007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976870060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976891041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976912022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976916075 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976934910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976947069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.976957083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976977110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976996899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.976996899 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977019072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977039099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977039099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977061033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977078915 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977081060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977104902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977117062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977125883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977147102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977164984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977508068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977530003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977564096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977565050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977601051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977602005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977629900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977664948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977673054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977699995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977737904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977741957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977763891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977783918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977799892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977804899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977826118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977842093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977850914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977873087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977888107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977893114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977914095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977936983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977941036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977957964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977977991 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.977977991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.977998972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978013992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978023052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978044033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978060007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978323936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978343964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978368998 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978382111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978404045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978421926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978436947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978473902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978478909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978507996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978540897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978548050 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978574038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978604078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978635073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978660107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978661060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978683949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978704929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978727102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978729010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978748083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978750944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978769064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978792906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978792906 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978812933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978813887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978837967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978859901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978862047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978882074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978902102 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.978903055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978924990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978945017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978966951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.978967905 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979060888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979325056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979360104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979391098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979393005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979424953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979446888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979459047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979491949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979496956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979526043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979547977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979567051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979568005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979589939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979609966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979631901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979651928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979655027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979681969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979684114 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979702950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979706049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979724884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979744911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979768038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979775906 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979789972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979799032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979809999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979830980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979844093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.979851961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.979914904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980127096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980154991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980184078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980191946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980222940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980233908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980258942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980298042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980304003 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980320930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980360985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980377913 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980396032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980416059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980434895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980456114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980463982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980479956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980479956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980501890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980523109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980529070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980545044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980566025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980573893 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980586052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980606079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980612040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980635881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980654001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980654955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980676889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980696917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980700016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980716944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980736971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980741978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.980757952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.980832100 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981122971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981158018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981194019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981225967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981244087 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981255054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981256962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981287956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981314898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981318951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981348991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981369019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981374025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981389999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981410980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981430054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981431961 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981451035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981471062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981494904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981504917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981514931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981518984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981539965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981559992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981570005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981580019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981589079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981600046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981621027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981628895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981641054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981678963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.981966019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.981997967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982018948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982053041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982073069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982104063 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982122898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982142925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982144117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982148886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982178926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982194901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982213974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982235909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982254982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982273102 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982276917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982297897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982317924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982320070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982338905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982357979 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982359886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982383966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982405901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982405901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982425928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982434034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982446909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982467890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982487917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982490063 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982508898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982522964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982531071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982556105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982573986 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982620955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982886076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982908010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982952118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.982964039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.982985020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983016968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983033895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983050108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983082056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983091116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983124018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983145952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983175039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983176947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983197927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983217955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983237982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983248949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983259916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983262062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983280897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983304024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983306885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983325958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983345985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983366013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983378887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983386040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983407021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983409882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983427048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983428955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983448982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983511925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983733892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983776093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983807087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983818054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983843088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983856916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983877897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983910084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983916044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.983943939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.983977079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984006882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984014988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984047890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984065056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984071970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984095097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984116077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984133959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984136105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984158993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984179974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984200954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984220982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984230995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984240055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984277964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984282017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984299898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984299898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984309912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984323025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984338999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984345913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984366894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984385967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984395027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984409094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984438896 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984719992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984740973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984769106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984770060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984801054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984812975 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984833002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984865904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984878063 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984901905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984936953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.984942913 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.984981060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985002041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985022068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985044003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985048056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985064030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985064983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985084057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985104084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985109091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985127926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985148907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985168934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985182047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985191107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985199928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985212088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985232115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985239029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985253096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985289097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985553026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985579014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985620022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985625982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985657930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985677958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985703945 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985718012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985750914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985753059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985786915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985797882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985807896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985829115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985843897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985848904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985872030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985889912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985893965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985913992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985934019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985940933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.985963106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.985982895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986004114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986015081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986033916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986046076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986054897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986076117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986097097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986109972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986118078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986131907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986135006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986156940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986177921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986185074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986219883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986532927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986571074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986589909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986610889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986638069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986661911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986670017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986701012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986721992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986732960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986766100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986778021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986787081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986807108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986828089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986833096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986851931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986872911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986872911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986893892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986913919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986916065 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986934900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986954927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986957073 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.986974955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.986994982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987019062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987040043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987042904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987054110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987083912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987163067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987418890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987448931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987472057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987483978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987513065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987529039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987545013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987577915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987587929 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987613916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987637043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987662077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987669945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987692118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987713099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987715960 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987749100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987761021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987771988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987796068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987807989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987818956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987838984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987862110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987863064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987883091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987903118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987907887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987924099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987943888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987946033 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987967014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.987982988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.987988949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988008976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988029003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988034010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988049984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988091946 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988344908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988379002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988409996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988410950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988441944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988466024 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988475084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988507986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988523006 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988533974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988565922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988584042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988586903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988609076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988629103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988642931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988650084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988672018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988682985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988694906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988717079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988728046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988735914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988756895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988778114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988779068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988804102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988807917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988825083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988845110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988848925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.988867998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.988892078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989140987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989164114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989197016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989201069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989229918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989258051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989269018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989315987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989337921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989357948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989382982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989387035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989415884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989439964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989464045 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989464045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989486933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989507914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989514112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989526987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989547968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989558935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989567995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989592075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989604950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989614010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989634037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989644051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989655018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989675045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989686966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989696026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989717007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989732981 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989737034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989761114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989770889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.989780903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.989825964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990175962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990200996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990236044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990242004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990263939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990283966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990330935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990334988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990353107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990356922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990401030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990411997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990422964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990446091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990467072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990474939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990487099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990508080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990518093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990528107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990549088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990565062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990570068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990591049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990590096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990614891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990636110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990648031 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990655899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990677118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990688086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990698099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.990722895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.990962982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991002083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991028070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.991039038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991075039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991081953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.991126060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991173983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991206884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991236925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991256952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991276979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991300106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991322041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991342068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991362095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991381884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991401911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991422892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991442919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991466999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991487980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991508007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991528034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991549015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991568089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991653919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991679907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991832972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.991939068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991974115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.991998911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992005110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992034912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992053032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992067099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992101908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992130995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992134094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992155075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992183924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992185116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992204905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992225885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992232084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992245913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992268085 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992269993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992291927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992311001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992319107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992341995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992361069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992362976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992383957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992403030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992407084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992423058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992443085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992444992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992464066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992496967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992804050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992835999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992855072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992866993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992891073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992921114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992942095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992944002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992965937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.992965937 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.992988110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.993006945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.993007898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.993027925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.993042946 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.993047953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.993067980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.993088007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.993089914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.993108034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.993129015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:51.993175983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:51.993216991 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.293297052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.293435097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.353538990 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.363312960 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.397088051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.397140026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.397169113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.397242069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.406261921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406337976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406419992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.406477928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406532049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406584024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406599998 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.406673908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406709909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406709909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.406763077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406764984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.406877041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.406944036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.406985998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407084942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407166958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407207012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407243967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407248974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407279015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407316923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407316923 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407351971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407351971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407394886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407427073 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407434940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407469988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407505035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407511950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407560110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407588005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407594919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407630920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407665014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407701969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407701015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407763004 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407803059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407883883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.407908916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.407994986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408030033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408060074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408087969 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408097029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408133030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408165932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408202887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408232927 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408246994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408282042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408288956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408289909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408323050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408360004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408365011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408395052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408428907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408447027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408464909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408492088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408551931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408596992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408607006 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408621073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408680916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408746004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408865929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408906937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408938885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.408951044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.408989906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409015894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409051895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409056902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.409086943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409090042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.409131050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409156084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.409169912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409224033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409275055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.409276009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409337997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409349918 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.409372091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409399986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409449100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409507036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.409537077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409756899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409816980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409821987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.409868956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409915924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.409919024 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.409965992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410012007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410047054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410084009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410110950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410145044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410180092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410151005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410213947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410218000 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410228968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410257101 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410264969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410306931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410325050 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410428047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410490990 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410523891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410633087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410671949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410721064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410731077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410758972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410804033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410804987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410842896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410866976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410892963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410932064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.410962105 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.410976887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411015034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411047935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.411061049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411096096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411130905 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.411176920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411216021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411247969 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.411313057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411382914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.411442041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411523104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411560059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411601067 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.411607027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411670923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411722898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411737919 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.411773920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411834002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.411835909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411890030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411911964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.411947012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.411987066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412117004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412208080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.412231922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.412303925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412404060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412446976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412477970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.412493944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412530899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412558079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.412578106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412611961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412635088 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.412661076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412708044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412714005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.412756920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412794113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412817955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.412839890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412878036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412892103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.412921906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412955046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.412977934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413000107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413052082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413103104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413206100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413266897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413319111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413357019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413391113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413412094 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413435936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413472891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413487911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413521051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413561106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413573980 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413602114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413639069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413654089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413681984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413717985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413737059 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413762093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413800001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.413810968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.413990974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414057016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414134026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414171934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414212942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414227009 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414254904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414300919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414308071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414344072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414378881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414397955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414422989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414460897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414473057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414501905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414540052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414554119 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414582968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414629936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414633036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414673090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414709091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414725065 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414783955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.414836884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.414901018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415071964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415154934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.415155888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415211916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415270090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415277004 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.415321112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415370941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415385962 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.415422916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415472031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415483952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.415545940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415601015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.415766001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415869951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415909052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.415923119 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.415958881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416007042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416011095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.416058064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416110992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416121006 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.416153908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416193008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416225910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.416235924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416286945 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.416289091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416343927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416384935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416398048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.416419029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416454077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416517019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416529894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.416579008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.416688919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416826010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416879892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416930914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.416951895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.416984081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417000055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417032957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417036057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417083025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417089939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417139053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417172909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417186022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417200089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417234898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417246103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417282104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417296886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417345047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417365074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417424917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417474985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417542934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417576075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417642117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417660952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417695045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417712927 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417730093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417740107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417763948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417783022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417807102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417840958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417850971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417860985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417886019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417907000 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417920113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417937040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.417953968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.417980909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418001890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418014050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418042898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418047905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418082952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418092966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418117046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418121099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418149948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418154001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418179035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418190956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418200970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418226957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418243885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418287039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418303967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418365955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418405056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418456078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418487072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418545008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418553114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418586969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418605089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418621063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418632984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418654919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418669939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418698072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418706894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418737888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418759108 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418771982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418788910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418807030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418817997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418840885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418863058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418874025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418891907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418909073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418921947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418941975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418962955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.418987989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.418992996 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419025898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419038057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419071913 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419105053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419157028 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419270992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419325113 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419383049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419421911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419436932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419456005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419466019 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419492006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419504881 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419527054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419538021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419560909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419574976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419595003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419606924 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419627905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419637918 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419670105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419675112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419708014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419718027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419742107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419751883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419775963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419790030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419810057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419821978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419842958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419855118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419877052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419887066 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419910908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419924021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419954062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.419955015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.419997931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420001030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420043945 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420078039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420125008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420155048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420202971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420237064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420291901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420306921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420371056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420393944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420447111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420464039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420496941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420510054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420531988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420547009 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420567036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420578957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420599937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420634985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420643091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420648098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420670033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420681953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420712948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420717955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420749903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420768023 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420808077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420839071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420903921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.420943022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.420999050 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421031952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421124935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421161890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421164036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421191931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421200037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421216011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421227932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421228886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421242952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421252012 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421255112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421269894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421286106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421288967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421305895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421320915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421335936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421345949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421353102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421367884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421369076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421384096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421399117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421403885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421416998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421430111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421430111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421444893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421452999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421461105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421475887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421475887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421494961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421505928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421510935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421521902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421525955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421540976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421549082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421555996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421571016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421571016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421586037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421597958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421601057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421619892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421621084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421637058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421650887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421652079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421668053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421683073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421694040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421698093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421714067 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421725035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421736002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421749115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421767950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421776056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421792030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421799898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421813965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421832085 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421840906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421853065 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421863079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421890974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421895027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421922922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421938896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421940088 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.421971083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.421979904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422003984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422013044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422038078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422046900 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422066927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422080994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422086000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422101974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422107935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422116995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422127962 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422132969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422147989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422151089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422163010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422174931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422178984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422194958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422209978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422213078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422229052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422230959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422244072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422255039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422260046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422275066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422286987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422291040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422306061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422319889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422322989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422338963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422353029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422363043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422374964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422378063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422396898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422405958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422414064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422429085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422445059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422445059 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422460079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422468901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422475100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422491074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422493935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422502041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422514915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422525883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422530890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422538042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422553062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422569990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422571898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422585011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422599077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422610044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422621965 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422632933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422652960 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422662973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422686100 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422689915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422708035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422719002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422734976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422743082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422760010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422764063 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422785997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422785997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422801971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422810078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422826052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422835112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422849894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422859907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422868967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422880888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422892094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422904968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422908068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422923088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422925949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422940969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422952890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422956944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422969103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422980070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.422981977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.422991991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423005104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423016071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423029900 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423031092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423043013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423054934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423067093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423074007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423082113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423096895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423105955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423113108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423130035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423139095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423157930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423162937 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423173904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423196077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423208952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423216105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423233032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423248053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423254967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423263073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423283100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423293114 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423299074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423314095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423315048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423326969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423341990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423353910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423362970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423365116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423383951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423401117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423404932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423415899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423430920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423438072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423445940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423460960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423475027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423477888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423490047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423508883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423516989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423532963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423548937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423552036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423569918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423584938 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423590899 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423609018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423620939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423631907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423650026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423650980 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423670053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423693895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423693895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423708916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423729897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423743010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423759937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423783064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423785925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423804998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423824072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423830986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423851967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423866987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423866987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423882008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423897028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423904896 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423912048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423923016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423930883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.423934937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423947096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423958063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423969030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423979998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.423991919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424004078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424021006 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424052954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424077034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424329996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424360037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424390078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424395084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424417019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424436092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424438953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424443007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424462080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424463034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424480915 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424484968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424503088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424510956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424523115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424532890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424547911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424552917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424566031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424586058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424590111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424601078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424614906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424623966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424638033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424649954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424653053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424668074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424670935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424685955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424695015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424702883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424717903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424729109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424734116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424740076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424751997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424756050 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424762964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424774885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424789906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424798012 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424808979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.424832106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.424860954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425246954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425288916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425314903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425318003 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425338984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425354958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425357103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425378084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425380945 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425400972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425405025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425415993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425440073 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425442934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425470114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425471067 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425498009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425508022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425514936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425529957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425539970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425544977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425559998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425578117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425578117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425592899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425606012 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425607920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425623894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425631046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425640106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425654888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425668955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.425669909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425714970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.425738096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426063061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426090956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426120043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426124096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426136017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426148891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426172972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426176071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426196098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426196098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426215887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426219940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426244974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426245928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426266909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426268101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426282883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426287889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426307917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426316023 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426325083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426341057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426347017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426361084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426368952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426383972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426394939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426398993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426414013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426429033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426436901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426445007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426460028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426466942 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426484108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426500082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426500082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426515102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426528931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426532984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426548958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426559925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426563978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.426582098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.426623106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427032948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427054882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427082062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427098036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427109003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427139044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427153111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427170992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427182913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427198887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427208900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427226067 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427236080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427253008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427253962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427278996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427284002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427294016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427303076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427309036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427325010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427328110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427342892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427356005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427360058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427375078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427391052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427393913 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427406073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427421093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427428961 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427436113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427450895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427460909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427469969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.427485943 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.427516937 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.439435005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439462900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439487934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439503908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439527035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439541101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439555883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439558029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.439570904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439589977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439589977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.439594984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.439605951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439620018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.439620972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439636946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439650059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.439666986 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.439681053 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.439704895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468112946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468239069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468281031 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468328953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468436003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468507051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468508005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468544006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468570948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468575001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468605042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468615055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468628883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468651056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468682051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468683958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468719959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468724966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468738079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468756914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468786001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468786955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468817949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468818903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468852043 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468858957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468883991 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468903065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.468909979 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468954086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.468977928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469032049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469109058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469172001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469258070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469360113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469377041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469399929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469419956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469432116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469443083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469464064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469480038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469495058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469511986 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469541073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469546080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469575882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469595909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469607115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469619036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469640970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469654083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469679117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469690084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469710112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469726086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469747066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469763041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469783068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469799995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469830036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469831944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469866037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469902992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.469942093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.469954014 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470000029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470007896 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470031977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470066071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470081091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470201015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470253944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470280886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470288992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470307112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470320940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470356941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470360994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470377922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470390081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470412016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470434904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470444918 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470469952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470498085 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470499992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470531940 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470534086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470550060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470571995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470590115 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470602989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470633030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470649958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470662117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470689058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470694065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470732927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470755100 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470808029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470813036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.470871925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.470926046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471000910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471004963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471061945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471065998 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471092939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471123934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471143961 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471163034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471210957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471231937 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471251965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471280098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471285105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471318960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471333027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471354008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471359968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471391916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471402884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471405029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471450090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471455097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471483946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471517086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471518993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471532106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471565962 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471574068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471626997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471679926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471801043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471812963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471865892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471879005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471930981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471940041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.471976042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.471997023 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472023010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472059011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472090960 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472109079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472112894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472127914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472156048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472186089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472203016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472214937 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472222090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472243071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472260952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472268105 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472307920 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472313881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472363949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472368002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472403049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472419977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472445965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472459078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472489119 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472501993 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472523928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472548962 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472568989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472590923 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472605944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472620010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472656965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472660065 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472703934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472738981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472738981 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472768068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472781897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472794056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472841024 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472868919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472906113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472930908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472938061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472963095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.472971916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.472982883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473006964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473031998 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473047018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473062038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473083973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473117113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473140955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473148108 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473159075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473177910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473201036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473216057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473237038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473264933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473272085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473284006 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473305941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473325968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473339081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473366976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473372936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473392010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473407030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473427057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473453999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473459005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473500967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473512888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473551035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473556995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473594904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473614931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473628998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473663092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473664999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473696947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473714113 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473731041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473742008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473773003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473783970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473809958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473823071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473844051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473856926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473877907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473889112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473923922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473934889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473956108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.473975897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.473989964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474001884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474024057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474035025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474056005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474067926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474091053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474104881 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474124908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474133968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474167109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474169016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474204063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474217892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474237919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474247932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474272966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474282026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474306107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474334002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474339008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474349976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474373102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474385977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474406958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474419117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474448919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.474461079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.474724054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.698189020 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.706629038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.740520954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.740555048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.740573883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.740672112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.748996973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749063969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749100924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749157906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749192953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749219894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749222994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749242067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749265909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749305964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749310017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749319077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749325991 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749365091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749386072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749387980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749423981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749458075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749459982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749511957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749526024 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749548912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749598980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749607086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749646902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749695063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749706984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749727011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749772072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749785900 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749804020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749826908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749847889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749857903 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749870062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749892950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749907017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749912977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749931097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749949932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749968052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.749988079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.749990940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750009060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750030994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750039101 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750046015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750063896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750089884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750103951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750113964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750119925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750137091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750144005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750155926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750179052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750189066 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750197887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750220060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750242949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750250101 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750261068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750262022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750282049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750307083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750308990 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750324011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750349998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750356913 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750368118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750391006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750413895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750416040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750432014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750456095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750459909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750473976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750499964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750500917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750518084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750541925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750545025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750560999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750580072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750595093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750608921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750608921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750619888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750622988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750639915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750658035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750679970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750685930 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750701904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750710964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750817060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750845909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750884056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750905037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750935078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750946999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750958920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750981092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.750984907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.750998020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751015902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751036882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751050949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751060009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751101017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751120090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751147032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751148939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751173973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751210928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751224041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751234055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751272917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751293898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751295090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751317978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751322031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751343966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751362085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751382113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751388073 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751399040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751418114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751439095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751456976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751463890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751482964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751487970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751508951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751532078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751533985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751543999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751554012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751602888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751611948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751636982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751661062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751662970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751682997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751708031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751713037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751725912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751744032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751765966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751777887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751787901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751831055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751849890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751853943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751877069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751878977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751893997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751913071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751935005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751944065 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.751951933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751970053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751993895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.751996994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752010107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752012014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752033949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752057076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752060890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752074957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752099037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752103090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752115965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752137899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752161980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752162933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752173901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752180099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752207041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752250910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752351999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752394915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752418041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752422094 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752435923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752454042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752492905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752506971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752516031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752538919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752548933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752557039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752572060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752593040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752610922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752614975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752638102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752655029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752706051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752712011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752728939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752727985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752769947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752783060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752791882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752810955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752830029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752851963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752856970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752870083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752873898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752891064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752897024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752919912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752939939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.752942085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752959967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752981901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.752986908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753000021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753017902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753038883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753057957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753061056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753071070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753083944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753108978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753108978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753130913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753154039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753154039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753175020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753196001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753197908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753221989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753242970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753251076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753261089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753329992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753356934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753388882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753465891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753513098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753607035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753629923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753668070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753671885 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753690958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753715038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753721952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753767967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753791094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753792048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.753854036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753878117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753917933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.753956079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754004002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754038095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754070044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754103899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754167080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754208088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754234076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754256964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754276037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754292011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754304886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754312992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754312992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754318953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754324913 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754334927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754344940 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754357100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754364014 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754381895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754404068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754415989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754425049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754446030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754456997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754467964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754487991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754506111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754508972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754527092 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754530907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754554987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754576921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754590988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754596949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754618883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754631042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754642010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754662037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754676104 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754699945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754719973 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754738092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754776001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754793882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754796982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754832029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754848957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754853964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754889011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754903078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754910946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754930973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754955053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754959106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.754977942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.754998922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755012035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755021095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755042076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755053997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755063057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755084038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755104065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755106926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755141973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755151033 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755177021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755192995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755206108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755239964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755256891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755279064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755305052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755331039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755336046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755367994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755388021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755393028 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755425930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755439043 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755458117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755479097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755510092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755515099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755542994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755563974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755579948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755600929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755656004 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755657911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755667925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755675077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755681992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755702972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755723953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755758047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755778074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755799055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755819082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755830050 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755841970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755847931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755856037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755866051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755871058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755887032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755908966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755918980 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755929947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755950928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755971909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.755980015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.755991936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756017923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756021976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756036997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756041050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756062984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756083012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756098032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756103992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756124020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756150007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756166935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756177902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756177902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756198883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756264925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756290913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756328106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756356955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756359100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756386995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756407022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756411076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756431103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756453037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756464958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756474018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756494045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756506920 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756514072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756535053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756555080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756561995 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756572962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756578922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756603003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756625891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756625891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756675959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756689072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756736994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756774902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756802082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756808043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756843090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756866932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756891012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756923914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756943941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.756949902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.756988049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757003069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757023096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757051945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757072926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757074118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757092953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757113934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757126093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757141113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757172108 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757185936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757208109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757229090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757252932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757276058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757296085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757317066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757338047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757358074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757373095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757379055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757394075 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757400036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757401943 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757407904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757414103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757424116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757445097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757458925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757466078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757487059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757508039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757520914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757616043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757621050 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757653952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757668972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757697105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757718086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757749081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757762909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757783890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757806063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757827044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757841110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757852077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757859945 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757874966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757895947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757913113 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757917881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757939100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757955074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.757960081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757980108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.757985115 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758001089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758025885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758054972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758106947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758224010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758233070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758255959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758277893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758327961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758368015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758403063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758431911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758436918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758447886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758455038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758459091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758491039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758512020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758533955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758558989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758582115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758610010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758635044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758646011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758657932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758680105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758702040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758723021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758743048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758764029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758785009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758794069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758810997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758835077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758856058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758878946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758888006 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.758899927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758923054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758944988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758965969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.758992910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759047985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759053946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759131908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759151936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759192944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759237051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759259939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759280920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759300947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759301901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759322882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759346962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759370089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759390116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759406090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759411097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759432077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759450912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759471893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759491920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759499073 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759516001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759551048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759581089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759592056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759630919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759660006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759665012 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759696960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759728909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759736061 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759762049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759793043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759809017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759825945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759861946 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759865999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759898901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759932041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.759942055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759967089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.759989023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760009050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760030031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760050058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760070086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.760071993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760092020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760113001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760137081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760160923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760178089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760198116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760214090 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.760214090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760236025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760257959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760279894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760299921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760320902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760335922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.760344982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760437965 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.760528088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760561943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760591984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760612965 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.760620117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760653973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760684967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760711908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760721922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.760732889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760749102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760766029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760782003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760803938 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760828972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760837078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.760850906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760871887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760893106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760914087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.760941982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761033058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761042118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761068106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761105061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761145115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761168957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761202097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761214972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761244059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761280060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761327028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761341095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761363029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761404991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761426926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761439085 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761450052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761471033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761477947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761495113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761517048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761537075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761559010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761567116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761579037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761599064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761620045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761641026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761665106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761665106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761687040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761708021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761729002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761749029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761769056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761769056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761790991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761811018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761833906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761854887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761939049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.761960983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.761991978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762025118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762033939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762056112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762093067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762120962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762130022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762156963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762181997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762202024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762226105 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762226105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762249947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762269974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762290955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762310982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762324095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762331963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762352943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762373924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762411118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762485981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762495041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762518883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762551069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762581110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762614012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762628078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762646914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762677908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762712955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762722015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762749910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762784004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762787104 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762851954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762866974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.762873888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762895107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762916088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762938023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762959003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762983084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.762999058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763005972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763027906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763050079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763070107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763089895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763111115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763115883 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763155937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763175964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763196945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763201952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763217926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763240099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763261080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763273954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763282061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763307095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763371944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763472080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763518095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763540030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763551950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763585091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763617992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763623953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763638973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763660908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763676882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763680935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763701916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763722897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763751030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763768911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763771057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763792992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763813972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763834953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763837099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763860941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763883114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763899088 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763956070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.763957977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.763991117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764027119 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764051914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764086008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764086008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764126062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764133930 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764149904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764183044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764190912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764223099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764246941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764256954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764280081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764321089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764322042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764345884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764367104 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764367104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764386892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764408112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764430046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764451981 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764455080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764477015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764497995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764513969 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764518976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764540911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764560938 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764580011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764581919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764601946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764627934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764651060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764653921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764672041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764694929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764713049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764714956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764736891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764802933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.764935970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.764987946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765022993 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765027046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765065908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765089035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765101910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765125036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765147924 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765156031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765177011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765197992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765218019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765228987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765244007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765265942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765286922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765290022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765309095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765330076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765351057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765360117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765372038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765422106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765439987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765475035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765491009 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765511990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765537977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765537977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765580893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765616894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765626907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765650034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765687943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765693903 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765723944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765752077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765757084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765784025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765809059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765842915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765861034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765868902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765892029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765912056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765933990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765939951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.765957117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.765979052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766000032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766000986 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766021013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766045094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766067982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766071081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766088009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766109943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766130924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766143084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766150951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766172886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766192913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766211033 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766216993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766241074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766272068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766386986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766452074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766453028 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766483068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766516924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766537905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766555071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766571045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766594887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766604900 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766628027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766659021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766681910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766689062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766701937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766726017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766746044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766748905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766771078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766792059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766807079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766813993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766834021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.766870022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.766921043 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.782876968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.782911062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.782932043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.782953024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.782974005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.782998085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.783018112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.783027887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.783040047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.783050060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.783060074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.783077002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.783078909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.783102036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:52.783108950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.783135891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:52.838574886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.005366087 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.047883987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.047943115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.047969103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.047991991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048038960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048059940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048083067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048105001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048168898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048192024 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048206091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048234940 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048239946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048264027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048297882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048305035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048327923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048372030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048398018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048440933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048402071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048463106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048501968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048522949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048547029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048553944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048561096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048582077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048605919 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048605919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048646927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048667908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048681974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048707962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048728943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048748970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048772097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048772097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048791885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048813105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048835039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048856020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048881054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048902988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048860073 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.048923969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048960924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048978090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.048999071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049000025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049020052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049041033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049067974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049094915 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049098969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049099922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049120903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049149036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049155951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049160004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049160004 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049181938 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049212933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049238920 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049240112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049273968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049294949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049314022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049329996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049350977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049384117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049396038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049429893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049453020 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049454927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049489021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049515963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049525023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049549103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049573898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049582958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049616098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049635887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049669027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049693108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049714088 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049722910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049726963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049757004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049776077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049794912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049814939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049838066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049860001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049860954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.049879074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049901009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049922943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049942970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049962044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.049981117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050004005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050024986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050025940 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050045013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050064087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050084114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050103903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050122976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050152063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050162077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050169945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050185919 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050189972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050194025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050195932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050199032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050204992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050226927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050266027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050275087 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050299883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050323009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050343037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050355911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050362110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050378084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050409079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050426960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050431967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050451040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050483942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050504923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050524950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050545931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050554991 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050568104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050601959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050618887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050626040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050664902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050687075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050699949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050720930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050756931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050780058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050806046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050812006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050848961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050874949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050884962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050925970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.050951958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.050970078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051007986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051028967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051042080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051064014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051084995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051105022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051150084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051160097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051172972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051192999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051217079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051239967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051261902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051280975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051302910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051307917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051323891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051364899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051379919 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051403999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051426888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051460028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051477909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051490068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051512003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051542997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051563025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051563978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051601887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051637888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051652908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051661015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051701069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051738977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051750898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051762104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051809072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051819086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051846981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051882029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051899910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051913977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051949978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.051970005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.051995039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052017927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052051067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052062035 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052072048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052094936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052119017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052139997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052140951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052161932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052182913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052203894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052228928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052228928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052253008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052274942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052299023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052313089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052320957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052345037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052366972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052388906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052409887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052417994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052432060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052453041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052476883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052510977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052514076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052541018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052576065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052592039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052612066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052643061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052664995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052669048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052690029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052719116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052745104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052755117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052781105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052819014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052839041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052858114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052884102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052922964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.052936077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052969933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.052985907 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053008080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053055048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053062916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053092003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053124905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053137064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053147078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053188086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053217888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053239107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053241014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053265095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053286076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053308010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053333044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053339958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053355932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053376913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053400040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053409100 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053421021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053443909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053467035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053488016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053512096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053524971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053534031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053555012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053576946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053597927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053611040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053622007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053643942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053669930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053702116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053709984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053740025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053774118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053778887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053802967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053824902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053853989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053870916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053875923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053895950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053917885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053961992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.053961992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.053982019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054002047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054040909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054061890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054075956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054097891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054116964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054142952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054167986 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054178953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054219007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054244995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054249048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054281950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054305077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054330111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054351091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054368019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054388046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054404020 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054409027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054430962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054447889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054450035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054470062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054491997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054502964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054512978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054538012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054558992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054577112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054594994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054594994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054615974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054616928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054640055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054661036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054670095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054682016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054703951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054724932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054745913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054752111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054766893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054785967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054800034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054814100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054848909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054848909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054889917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054905891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.054913044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054945946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054970026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.054991961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055012941 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055033922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055058956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055092096 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055099010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055150986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055171967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055180073 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055191994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055234909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055237055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055258989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055301905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055305958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055341959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055365086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055387020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055399895 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055434942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055444956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055459976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055500031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055501938 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055522919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055543900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055567980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055572033 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055588961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055608988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055629015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055648088 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055649042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055670023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055691004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055711985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055736065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055741072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055757999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055757999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055778980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055797100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055815935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055818081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055838108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055857897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055865049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055879116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055897951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055916071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055921078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055938005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055953979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055974007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.055983067 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.055994987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056034088 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056045055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056068897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056082964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056103945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056124926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056147099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056158066 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056175947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056197882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056230068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056233883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056317091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056356907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056379080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056401014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056425095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056469917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056476116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056509972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056531906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056541920 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056551933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056591034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056598902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056612015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056629896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056647062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056694031 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056724072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056746006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056777954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056794882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056813002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056830883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056852102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056869984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056886911 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056905031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056907892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.056925058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056943893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056963921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.056987047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057012081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057013988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057055950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057101965 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057102919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057131052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057148933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057178020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057194948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057219982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057224035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057241917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057260036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057285070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057302952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057312012 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057322979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057343960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057358027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057364941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057388067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057410002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057414055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057429075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057449102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057468891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057488918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057492018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057509899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057528973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057550907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057560921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057573080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057594061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057614088 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057615995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057662964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057670116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057682991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057702065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057727098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057729959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057768106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057796001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057811022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057835102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057859898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057868004 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057909012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057929993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057934046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.057950020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.057967901 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058001041 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058010101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058028936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058052063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058058023 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058093071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058115959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058123112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058135986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058157921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058176041 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058182955 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058199883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058221102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058240891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058242083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058264971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058285952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058306932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058312893 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058327913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058351040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058374882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058398008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058422089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058422089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058445930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058465004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058465958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058484077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058504105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058542967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058542967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058562994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058583975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058604002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058608055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058651924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058662891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058676958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058697939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058720112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058743954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058764935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058784008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058789015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058825016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058845043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058860064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058887005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058907986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058912039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058943987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058960915 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.058964014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.058988094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059009075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059012890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059031010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059051991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059075117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059093952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059109926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059149027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059175014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059179068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059195995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059216022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059221983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059245110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059266090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059283018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059330940 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059376955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059401035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059425116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059444904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059447050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059464931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059484005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059500933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059521914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059582949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059588909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059613943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059634924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059650898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059655905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059674978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059694052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059726000 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059737921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059762001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059779882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059806108 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059825897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059847116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059853077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059868097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059889078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.059906960 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059957027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.059999943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060024977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060070992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060071945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060095072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060112000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060132027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060154915 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060182095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060206890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060230017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060230017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060281992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060282946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060307026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060328960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060340881 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060349941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060370922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060391903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060396910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060412884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060436010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060457945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060461044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060477972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060499907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060516119 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060519934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060540915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060560942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060579062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060581923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060606956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060630083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060657978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060678959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060681105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060713053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060734034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060741901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060765028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060785055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060791969 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060805082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060836077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060847998 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060858965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060880899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060902119 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060920000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060942888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.060956001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.060961962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061006069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061012983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061057091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061074972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061078072 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061121941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061122894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061155081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061175108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061182022 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061213970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061238050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061258078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061280012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061300039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061331034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061341047 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061362028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061382055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061383009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061414003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061436892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061459064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061460972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061482906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061505079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061512947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061530113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061552048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061567068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061572075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061593056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061614990 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061620951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061636925 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061661005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061681032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061681986 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061714888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061738014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061743021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061769962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061793089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061803102 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061841011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061849117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061863899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061902046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061903000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061923981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061944962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.061974049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.061992884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062017918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062042952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062043905 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062064886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062084913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062098980 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062104940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062127113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062144995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062160015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062165976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062186956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062208891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062212944 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062232018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062254906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062275887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062278986 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062295914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062316895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062336922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062350988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062357903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062383890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062406063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062410116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062427044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062448978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062469006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062478065 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062489986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062509060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062529087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062534094 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062551022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062572956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062593937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062596083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062616110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062638998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062649965 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062660933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062681913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062702894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062704086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062726021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062752008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062760115 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062772989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062794924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062814951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062818050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062839031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062860966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062879086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062881947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062906981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062930107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062935114 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.062952042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062974930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062998056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.062999964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063020945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063043118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063050032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063066006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063091040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063107967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063133001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063153982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063158035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063179970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063203096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063211918 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063245058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063268900 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063268900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063296080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063319921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063323021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063343048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063364983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063389063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063390970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063411951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063436031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063458920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063466072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063482046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063505888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063508034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063528061 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063550949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063554049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063570976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063591957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063606977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063608885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063658953 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063709021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063837051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.063910961 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.063920021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.064001083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.253429890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.253616095 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.323091030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363460064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363486052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363523006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363543034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363619089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363641024 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363656044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363672972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363678932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363713026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363719940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363735914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363770962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363787889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363812923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363836050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363837957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363857985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363861084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363879919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363883018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363902092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363903999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363923073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363944054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363965988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.363967896 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.363990068 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364012957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364032984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364054918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364074945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364097118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364119053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364140034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364164114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364165068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.364186049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364207029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364207029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.364226103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364248037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364268064 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364269018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.364291906 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.364291906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364315033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364317894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.364340067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.364366055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.364464045 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.365493059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365524054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365572929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365593910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365597963 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.365643024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365644932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.365665913 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365688086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365719080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.365746975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365768909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365799904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.365809917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365844011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365864992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.365866899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365890026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365921974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.365933895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365976095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.365998983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366002083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366020918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366044044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366070986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366094112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366120100 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366138935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366172075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366197109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366214991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366256952 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366264105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366265059 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366288900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366322994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366347075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366327047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366400003 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366453886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366477013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366497993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366499901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366518021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366540909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366561890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366563082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366583109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366605043 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366606951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366630077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366648912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366652012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366673946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366677046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366694927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366714001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366734982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366734982 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366756916 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366780996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366800070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366805077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366822958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366825104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366847038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366869926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366889954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366892099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366925001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366947889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366971970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.366981030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.366997957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367026091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367037058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367058992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367091894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367100954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367194891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367197037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367230892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367254972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367279053 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367297888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367333889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367346048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367356062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367398024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367403984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367429972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367470026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367479086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367495060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367538929 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367546082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367569923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367592096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367613077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367624044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367635012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367655993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367664099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367680073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367701054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367702007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367722034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367743969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367744923 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367764950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367786884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367788076 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367804050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367825985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367847919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367849112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367871046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367881060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367892981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367914915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367935896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.367958069 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367968082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.367974043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368017912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368038893 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368042946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368067026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368088007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368108034 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368110895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368130922 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368149996 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368153095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368179083 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368195057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368216991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368243933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368268967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368294001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368318081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368326902 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368366003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368386984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368402958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368444920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368464947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368480921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368508101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368527889 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368529081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368571043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368573904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368592978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368613958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368633986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368635893 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368654966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368680954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368688107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368705988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368726015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368745089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368745089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368766069 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368786097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368788004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368808985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368809938 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368829012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368849993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368850946 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368870974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368891954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368895054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368911982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368932009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368947983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368954897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368977070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.368977070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.368998051 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369018078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369019985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369039059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369061947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369090080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369110107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369132042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369133949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369153023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369175911 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369193077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369226933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369246960 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369250059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369278908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369298935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369299889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369329929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369352102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369371891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369410038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369427919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369467974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369488001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369529963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369551897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369554043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369592905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369612932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369637966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369667053 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369673967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369674921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369678020 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369699001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369709969 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369728088 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369730949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369735003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369755983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369776011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369796038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369811058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369817972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369839907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369860888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369868040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369882107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369903088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369910002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369923115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369942904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369947910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.369962931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369986057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.369993925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370008945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370028973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370033026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370049000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370070934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370074987 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370090961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370111942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370120049 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370132923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370157957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370160103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370182037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370203018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370210886 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370223999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370244980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370253086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370282888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370292902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370306969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370327950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370348930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370363951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370368958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370389938 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370398998 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370426893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370440960 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370449066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370469093 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370492935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370503902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370529890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370543957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370551109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370589972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370601892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370613098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370647907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370661974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370672941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370712996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370724916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370735884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370774031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370788097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370795965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370835066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370842934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370857000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370897055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370907068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370919943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370939970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370960951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.370970011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.370980978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371005058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371014118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371026993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371047974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371056080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371068954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371089935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371100903 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371109962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371144056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371149063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371170044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371189117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371206999 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371211052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371231079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371249914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371251106 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371270895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371303082 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371309042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371334076 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371351957 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371356964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371378899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371393919 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371402025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371443987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371458054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371474028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371495962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371503115 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371516943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371537924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371546984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371562958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371586084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371598005 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371627092 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371638060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371649027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371690989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371700048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371716976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371754885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371764898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371776104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371812105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371828079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371833086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371875048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371880054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371921062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371943951 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.371977091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.371978045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372025013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372028112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372057915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372080088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372109890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372109890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372132063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372159958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372165918 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372206926 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372215033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372245073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372265100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372287035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372292042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372308016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372329950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372338057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372353077 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372376919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372380018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372396946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372419119 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372421026 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372441053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372472048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372474909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372492075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372514963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372526884 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372554064 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372555017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372587919 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372612953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372627974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372642994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372664928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372679949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372685909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372706890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372726917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372726917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372762918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372771978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372782946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372812033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372823954 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372829914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372872114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372874975 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372905970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372925997 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372950077 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.372967005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.372992039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373009920 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373027086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373047113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373068094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373068094 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373090029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373110056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373127937 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373130083 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373150110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373169899 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373172045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373193026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373195887 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373214006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373234034 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373255968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373256922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373277903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373296976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373296976 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373317003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373327017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373337030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373357058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373373032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373377085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373397112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373415947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373420000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373441935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373444080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373462915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373482943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373500109 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373502970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373522043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373542070 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373542070 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373562098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373569965 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373584986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373606920 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373610020 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373636007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373658895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373666048 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373680115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373696089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373701096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373719931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373742104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373750925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373763084 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373783112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373794079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373801947 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373825073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373826027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373847961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373868942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373883009 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373891115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373912096 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373924017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373931885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373951912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373954058 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.373971939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.373996973 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374016047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374018908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374038935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374056101 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374058962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374080896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374084949 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374100924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374121904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374141932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374142885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374166012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374182940 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374186993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374208927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374216080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374229908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374250889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374252081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374272108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374293089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374308109 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374313116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374336004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374339104 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374356031 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374376059 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374397039 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374397993 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374418020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374437094 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374439955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374460936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374469042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374480963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374505043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374526978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374526978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374547005 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374567986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.374569893 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.374598980 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.416651011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.517211914 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.559684992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559719086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559734106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559746027 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559762001 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559781075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559798956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559814930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559844971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559858084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.559868097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559885025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559890032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.559895992 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.559906006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559927940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559935093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.559951067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.559952021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.559978008 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.559994936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560045004 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560060978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560065031 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560091019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560107946 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560118914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560131073 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560141087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560158014 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560163975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560189009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560190916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560209036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560223103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560229063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560247898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560261011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560271978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560290098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560302973 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560311079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.560339928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560364962 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.560987949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561033010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561060905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561091900 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561100006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561110973 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561124086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561146021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561150074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561167002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561187029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561189890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561208010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561223030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561228037 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561249018 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561249971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561271906 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561283112 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561294079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561314106 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561317921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561335087 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.561350107 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561387062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.561980963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562016010 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562032938 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562052011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562052965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562066078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562074900 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562094927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562096119 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562118053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562135935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562155008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562175989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562186003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562192917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562202930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562225103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562251091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562351942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562374115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562391043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562402964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562441111 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562927008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562944889 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562975883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.562997103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.562999964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563030958 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563035965 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563052893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563076973 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563083887 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563101053 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563107967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563136101 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563152075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563163042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563175917 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563189983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563199043 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563218117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563220978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563236952 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563244104 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563257933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563275099 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563313007 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563889980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563913107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563930988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563949108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563961029 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563971996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.563981056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.563994884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564024925 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564052105 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564312935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564340115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564368010 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564373970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564388990 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564404011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564419031 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564424992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564446926 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564450979 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564466953 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564476013 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564488888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564500093 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564508915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564526081 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564548016 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564570904 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564577103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564594030 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564614058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564634085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.564672947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564692974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.564696074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565318108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565342903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565357924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565373898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565397024 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565397978 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565432072 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565434933 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565454960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565459967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565478086 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565495968 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565500975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565521002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565521955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565541983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565541983 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565562963 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565570116 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565609932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565737009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565753937 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.565793037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.565824032 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566215038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566231966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566261053 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566277027 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566281080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566314936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566314936 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566349983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566370964 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566373110 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566375971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566395044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566399097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566416979 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566422939 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566441059 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566448927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566464901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566472054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566487074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566493988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566513062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566514015 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566534042 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.566535950 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566560030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.566580057 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567212105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567250967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567281961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567293882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567301989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567312956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567323923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567343950 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567344904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567413092 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567425966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567653894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567677021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567715883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567738056 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567754984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567756891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567776918 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567795038 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567795992 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567814112 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567831039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567848921 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567871094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567893028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.567903042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567909956 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.567955017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568028927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568051100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568106890 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568623066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568660021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568680048 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568701982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568717957 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568726063 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568733931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568748951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568751097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568772078 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568787098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568799973 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568809986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568829060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568846941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568861961 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568866968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568887949 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568892002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568908930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.568922997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.568950891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.569662094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569681883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569709063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569735050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569756985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569760084 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.569782019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569787025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.569802999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569822073 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569834948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.569843054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569858074 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.569864035 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569883108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569904089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569914103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.569926977 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569941998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.569952011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.570071936 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.570564032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.570589066 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.570611000 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.570632935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.570636988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.570650101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.570660114 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.570667982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.570732117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.570960045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.570985079 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571019888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571027994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571048021 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571062088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571078062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571082115 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571104050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571113110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571136951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571144104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571166039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571171045 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571187019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571202040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571211100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571223974 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571233988 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571248055 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571255922 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571264029 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571281910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571351051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.571969032 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.571986914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572001934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572029114 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572048903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572058916 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.572067976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572078943 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.572091103 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572108984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572122097 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.572132111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572153091 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.572154999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572173119 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572184086 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.572192907 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572213888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572231054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.572233915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572264910 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.572290897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.572912931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572947979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572979927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.572990894 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573000908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573010921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573020935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573036909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573045015 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573067904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573079109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573087931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573103905 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573110104 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573121071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573142052 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573156118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573163033 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573184013 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573205948 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573210001 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573229074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573240042 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573259115 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573292971 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.573870897 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573890924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573904991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573919058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573931932 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573951006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.573976040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574018002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574282885 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574325085 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574340105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574353933 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574368954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574392080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574410915 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574418068 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574424982 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574445009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574455023 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574465036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574479103 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574486017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574505091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574510098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574525118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574536085 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574548006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574568987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574580908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574588060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.574626923 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.574661016 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575182915 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575197935 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575213909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575259924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575278044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575282097 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575294018 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575325966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575345039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575360060 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575366020 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575387955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575402975 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575408936 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575448036 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575469017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575489998 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575500011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575505972 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575508118 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.575509071 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575556040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.575584888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.576271057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576306105 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576333046 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576351881 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576356888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.576371908 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576387882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.576394081 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576415062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576436043 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.576436996 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576458931 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576469898 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.576481104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576497078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.576503038 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576524019 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576539040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576539040 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.576555967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.576625109 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.576637030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577219009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577243090 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577260017 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577286959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577305079 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577311039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577333927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577339888 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577416897 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577429056 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577569962 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577632904 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577640057 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577661991 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577682972 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577693939 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577714920 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577724934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577734947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577747107 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577769995 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577776909 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577790022 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577800989 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577811956 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577822924 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577833891 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577852011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577860117 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577876091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577883959 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.577898979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577917099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.577924967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.578042984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.578564882 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578583002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578609943 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578624964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578649044 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.578670025 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578691959 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578706980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578718901 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.578725100 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578737974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578749895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578753948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.578762054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578829050 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578840971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578857899 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.578918934 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.578949928 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.579653978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579683065 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579694986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579710007 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579720974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579732895 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579745054 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579756975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579767942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579780102 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579787970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.579792023 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579821110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.579865932 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.579931021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579952955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.579971075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580008030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.580044985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.580532074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580554008 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580574989 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580593109 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580615044 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580626011 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.580635071 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580667019 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.580698967 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.580921888 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580957890 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580980062 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.580993891 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.580998898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581022978 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581029892 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.581051111 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581062078 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.581068039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581084967 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581099987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581111908 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.581115961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581130981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581146002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581155062 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.581161976 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581182003 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581197977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.581238985 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.581945896 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581970930 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.581990004 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582010984 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582027912 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582041979 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582056046 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.582056999 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582073927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582087994 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582092047 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.582108021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582127094 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582171917 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.582190037 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.582277060 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582294941 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582314014 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582344055 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.582396030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.582856894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582881927 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582916975 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582935095 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582954884 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582962036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.582978964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.582995892 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583010912 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.583014965 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583031893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583050966 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583056927 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.583070040 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583089113 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583107948 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.583122969 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583149910 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583168030 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.583219051 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.583873987 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583889961 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583900928 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583913088 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583928108 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583944082 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.583992958 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.584054947 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.584239960 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584258080 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584296942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584317923 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584322929 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.584338903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584350109 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.584355116 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584369898 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584388971 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584408045 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584412098 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.584429026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584448099 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584461927 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.584502935 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.584562063 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584579945 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584594011 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.584635973 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.584667921 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.585267067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585292101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585306883 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585321903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585336924 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585351944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585366964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585371017 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.585381985 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585401058 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585417986 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585426092 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.585433006 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585448980 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585464954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.585468054 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.585479021 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586182117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586210012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586226940 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586236000 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.586256981 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586261988 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.586266994 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.586273909 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586288929 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586304903 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586308002 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.586318970 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586334944 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586349964 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586360931 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.586405993 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.586447954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586467028 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586486101 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586503983 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.586508036 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.586563110 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587193012 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587213039 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587234974 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587255955 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587268114 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587274075 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587290049 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587301970 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587347984 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587551117 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587567091 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587596893 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587611914 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587626934 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587629080 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587641954 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587660074 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587667942 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587682009 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587706089 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587706089 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587734938 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587744951 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587752104 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587766886 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587783098 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587790966 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587800026 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.587848902 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.587882996 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.588615894 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.588634968 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.588650942 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.588660002 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.588711977 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.588747025 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.589323997 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.603280067 CEST	443	49734	13.225.74.90	192.168.2.4
Jul 19, 2021 11:49:53.604100943 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:53.824210882 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:49:54.648893118 CEST	49734	443	192.168.2.4	13.225.74.90
Jul 19, 2021 11:50:26.444125891 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:50:26.497263908 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:50:26.497387886 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:50:26.516354084 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:50:26.568443060 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:50:26.569610119 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:50:26.569643974 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:50:26.569668055 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:50:26.569789886 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:50:26.626491070 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:50:26.678726912 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:50:26.680510998 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:50:26.683418989 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:50:26.774729013 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:50:26.776513100 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:50:26.844782114 CEST	49749	80	192.168.2.4	217.195.25.242
Jul 19, 2021 11:50:26.897306919 CEST	80	49749	217.195.25.242	192.168.2.4
Jul 19, 2021 11:50:26.898468971 CEST	49749	80	192.168.2.4	217.195.25.242
Jul 19, 2021 11:50:26.899100065 CEST	49749	80	192.168.2.4	217.195.25.242
Jul 19, 2021 11:50:26.951317072 CEST	80	49749	217.195.25.242	192.168.2.4
Jul 19, 2021 11:50:26.985891104 CEST	80	49749	217.195.25.242	192.168.2.4
Jul 19, 2021 11:50:26.986052036 CEST	49749	80	192.168.2.4	217.195.25.242
Jul 19, 2021 11:50:27.053327084 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:27.214749098 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:27.214848042 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:27.215681076 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:27.379077911 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:27.379126072 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:27.379151106 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:27.379165888 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:27.379249096 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:27.379317045 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:27.392875910 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:27.555084944 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:27.555182934 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:27.556569099 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:27.758743048 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.133781910 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.133842945 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.133892059 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.133940935 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.133946896 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.133994102 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.134043932 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.134053946 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.134068966 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.134111881 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.134167910 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.134222984 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.134278059 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.134295940 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.134306908 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.138550997 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.148118019 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.148546934 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295341969 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295375109 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295394897 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295418024 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295464039 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295478106 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295504093 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295512915 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295547009 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295547962 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295583963 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295608044 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295614004 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295619965 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295654058 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295669079 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295694113 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295702934 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295706987 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.295730114 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295748949 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.295789957 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.297243118 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.309300900 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.309339046 CEST	443	49750	34.202.46.34	192.168.2.4
Jul 19, 2021 11:50:28.309396982 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.309511900 CEST	49750	443	192.168.2.4	34.202.46.34
Jul 19, 2021 11:50:28.372338057 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:28.443658113 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:50:28.444003105 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:28.485605001 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:28.556400061 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:50:28.559777021 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:50:28.559823990 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:50:28.559863091 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:50:28.559895992 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:50:28.560002089 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:28.560041904 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:28.606389046 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:28.677966118 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:50:28.733596087 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:28.739855051 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:28.825124979 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:50:28.874181986 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:50:29.504945993 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.574476957 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.574590921 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.575565100 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.645015955 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.646297932 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.646326065 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.646348953 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.646368980 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.646426916 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.646457911 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.662373066 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.731698036 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.731837034 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.732598066 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.801531076 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.801706076 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.807547092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.876566887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.876696110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.877309084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.946463108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.946512938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:29.946604967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.947236061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:29.950639963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020001888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020061016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020101070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020137072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020184994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020226955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020252943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020263910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020303011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020303965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020334005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020339966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020370007 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020375967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020375967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020381927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020407915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020414114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.020487070 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.020499945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.090852976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.090915918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.090954065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.090991974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091028929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091075897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091106892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091133118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091139078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091156006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091197968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091234922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091272116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091310024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091322899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091331959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091346979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091375113 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091379881 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091386080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091424942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091458082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091471910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091515064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091567993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091615915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091625929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091654062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091717958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091800928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091842890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.091881037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.091923952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160509109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160562992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160600901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160640001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160676003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160696983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160713911 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160723925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160728931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160732031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160767078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160805941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160842896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160861969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160866976 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160881996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160914898 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160917044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160943985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160954952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.160978079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.160990953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161037922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161039114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161043882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161082029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161119938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161178112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161185980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161312103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161381960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161421061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161458969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161494970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161531925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161534071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161545038 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161546946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161549091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161648035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161685944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161725998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161732912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.161793947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.161864042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162019014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162058115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162095070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162111998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162122011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162130117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162143946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162168026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162204981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162209034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162214041 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162328005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162367105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162411928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162416935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162482023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162523031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162559032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162606001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162621021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162643909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162678957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.162684917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.162688971 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.165374994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230150938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230207920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230247021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230283022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230321884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230340958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230359077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230376005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230387926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230438948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230483055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230520964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230556011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230559111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230596066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230628967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230633020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230670929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230706930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230716944 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230753899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230796099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230803013 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230833054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230870008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230870008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230907917 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230926037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230945110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.230962038 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.230988026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231024981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231070995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231122971 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.231142998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231192112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231204987 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.231228113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231266975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231306076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231342077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231379032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231379986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.231389999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.231417894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231465101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231534004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.231543064 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.231657982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231694937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.231795073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232024908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232064009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232100964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232137918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232183933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232197046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232206106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232225895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232233047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232264042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232302904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232340097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232341051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232378960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232415915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232426882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232433081 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232453108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232456923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232501030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232530117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232536077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232543945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232635021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232644081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232681036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232748985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232826948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232867002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232891083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232903957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.232913971 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232918024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.232939959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233001947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233048916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233098030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.233103991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.233180046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233218908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233354092 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233397007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233438015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.233452082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.233535051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233583927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233627081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233664036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233696938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.233700991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233738899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233742952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.233747959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.233884096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233891964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.233949900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.233987093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234024048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234028101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.234061956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234077930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.234081984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.234097958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234168053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.234308958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234350920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234391928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.234432936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234451056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.234469891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234601021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234669924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234705925 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.234798908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234838009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.234875917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.235188961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.300487995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300518990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300539017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300559998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300580025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300601006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300625086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300647020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300672054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300694942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300708055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.300717115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300740957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300761938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300780058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.300786018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.300786018 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300810099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300832033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300848961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.300853014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.300858021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300883055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300904036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300937891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.300944090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.300971031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.300992966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301013947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301037073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301048994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301054001 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301064014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301086903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301126003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301131010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301171064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301189899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301214933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301280022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301285982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301295996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301372051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301394939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301410913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301450014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301511049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301562071 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301588058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301594019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301625013 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301651955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301666021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301703930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301728964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301752090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301764965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301774979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301799059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301821947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301845074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301846027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301851988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301867008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301892042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301915884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.301923990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301929951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.301939011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302006960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302010059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302020073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302074909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302141905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302143097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302165985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302179098 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302191019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302216053 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302237034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302246094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302261114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302283049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302297115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302301884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302373886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302412033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302434921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302472115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302514076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302522898 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302552938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302576065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302603960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302740097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302763939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302773952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302789927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302814007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302835941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302843094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302859068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302881002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302885056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302903891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302932024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302944899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302963972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.302972078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302995920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.302999020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303019047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303040981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303062916 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303064108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303069115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303086996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303131104 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303158998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303160906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303220034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303244114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303266048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303287983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303325891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303328991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303354025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303358078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303358078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303383112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303396940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303405046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303430080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303447008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303452969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303495884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303508997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303555965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303585052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303591967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303622961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303643942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303668976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303673983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303679943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303693056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303714991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303738117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303745985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303750992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303761959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303785086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303807020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303828955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303832054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303834915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303858042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303869009 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303880930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303903103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303930998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303936005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303944111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303966999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.303986073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.303989887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304012060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304032087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304126978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304187059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304208040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304231882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304255009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304276943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304286957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304301023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304313898 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304317951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304323912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304349899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304354906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304373980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304394960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304419994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304420948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304500103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304505110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304533005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304554939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304575920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304600954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304630041 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304666996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304667950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304694891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304725885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304730892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304759979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304785013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.304819107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304826021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304874897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.304994106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305018902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305039883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305063009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305085897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305113077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305114985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305120945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305136919 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305157900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305181026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305181026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305185080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305203915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305222988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305226088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305248976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305264950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305270910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305295944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305319071 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305322886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305326939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305341005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305361032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305363894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305387020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305408001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305416107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305419922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305430889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305457115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305481911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305486917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305491924 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305505037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305526972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305548906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305548906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305553913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305572033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305593967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305619001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305623055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305629015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305639982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305665970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305689096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305691004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305696011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305711031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.305757046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.305762053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.369889975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.369914055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.369927883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.369940042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.369996071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370014906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370028019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370039940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370062113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370083094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370098114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370102882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370102882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370126963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370148897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370157003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370217085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370220900 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370271921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370296001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370316029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370337963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370384932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370398998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370405912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370461941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370486021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370505095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370523930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370547056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370565891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370569944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370570898 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370604038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370605946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370631933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370656967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370675087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370682001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370707989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370713949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370721102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370748997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370769024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370781898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370781898 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370814085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370815039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370835066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370848894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370892048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370892048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370923996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370960951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.370982885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.370985031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371006966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371009111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371028900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371068001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371136904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371149063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371162891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371176958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371186972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371212959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371237040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371253014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371259928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371268034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371295929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371320009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371329069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371335030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371345043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371368885 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371404886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371412039 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371422052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371429920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371454954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371484995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371503115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371510029 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371512890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371537924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371562004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371586084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371594906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371601105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371608973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371634007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371658087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371669054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371675968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371689081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371716022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371731997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371738911 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371740103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371766090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371781111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371783972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371817112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371845007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371850967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371860027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371869087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371893883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371897936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371917963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371927023 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371941090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371964931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.371969938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.371988058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372003078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372018099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372044086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372072935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372076035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372083902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372106075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372131109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372143984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372149944 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372153997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372178078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372193098 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372201920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372217894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372232914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372260094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372272015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372279882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372283936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372309923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372322083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372334003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372358084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372373104 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372381926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372397900 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372406960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372436047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372462034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372468948 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372476101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372486115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372510910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372524977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372531891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372534037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372556925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372581005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372591019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372612000 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372631073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372654915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372664928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372674942 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372678995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372694016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372709036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372740984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372749090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372755051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372769117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372792959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372812033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372817993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372821093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372843981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372862101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372879982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372904062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372929096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372953892 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372955084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372977972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372982025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.372984886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.372986078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373012066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373013020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373035908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373064041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373090029 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373096943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373099089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373100996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373122931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373123884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373150110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373155117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373174906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373224974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373229027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373253107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373253107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373256922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373277903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373302937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373302937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373328924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373332024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373353004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373378038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373402119 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373413086 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373419046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373430967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373454094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373457909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373487949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373512030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373528004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373536110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373537064 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373560905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373584032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373608112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373610020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373635054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373636007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373667002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373667955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373693943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373718977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373754978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373779058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373795986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373800993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373816013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373819113 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373825073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373833895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373841047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373851061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373861074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373878956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373898029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373924017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373934984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373944998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373945951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373970032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.373987913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.373992920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374013901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374017000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374041080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374042988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374068022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374079943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374104023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374130011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374136925 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374146938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374152899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374154091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374176979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374192953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374202013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374221087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374224901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374231100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374295950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374524117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374548912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374579906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374608994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374639988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374666929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374676943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374691010 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374691010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374716043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374752998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374758959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374763966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374771118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374784946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374835968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.374878883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374905109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374927998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374952078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.374974966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375004053 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375004053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375014067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375030041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375052929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375056982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375066042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375085115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375112057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375129938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375134945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375143051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375158072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375181913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375205994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375228882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375256062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375258923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375267029 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375284910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375308037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375332117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375336885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375348091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375350952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375354052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375370979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375390053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375395060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375417948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.375454903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.375463963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.443254948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443305969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443418026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.443511963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443558931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443598986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443635941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443666935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.443670988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443713903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.443721056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443770885 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443814993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443850040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443891048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.443898916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.443908930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.443916082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.443952084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444000006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444011927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444060087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444060087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444107056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444140911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444158077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444169044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444191933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444220066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444245100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444262981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444299936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444349051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444401026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444405079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444422960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444457054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444458961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444509983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444542885 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444577932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444612026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444628954 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444642067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444664001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444681883 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444719076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444757938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444817066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444835901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444848061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.444871902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444912910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444948912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.444993019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445043087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445065022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445082903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445091963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445094109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445127964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445146084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445198059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445238113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445275068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445280075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445293903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445302010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445329905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445337057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445378065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445426941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445445061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445455074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445471048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445480108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445523977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445566893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445585012 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445595980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445621967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445661068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445686102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445713043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445719957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445735931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445765018 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445802927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445837975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445874929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445882082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445892096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445899010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445934057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.445935011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.445982933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446012974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446037054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446078062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446084976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446093082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446135998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446171999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446202040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446217060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446240902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446271896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446314096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446326017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446367979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446384907 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446398020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446418047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446460962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446479082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446508884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446516991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446521044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446553946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446588039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446607113 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446613073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446621895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446674109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446687937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446708918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446767092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446779013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446814060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446850061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446866989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.446883917 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446926117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446964025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.446996927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447021961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447029114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447031975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447067022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447077990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447082043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447103024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447135925 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447174072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447212934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447247028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447252989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447290897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447328091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447334051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447340965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447362900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447396994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447433949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447463989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447479963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447485924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447526932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447561026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447603941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447643995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447676897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447700977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447707891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447710991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447741032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447745085 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447777987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447798967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447804928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447812080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447828054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447853088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447892904 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447897911 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.447911978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447957993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.447992086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448026896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448039055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448049068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448061943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448111057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448144913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448179960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448204994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448214054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448215008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448236942 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448257923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448296070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448308945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448316097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448329926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448364019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448374033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448379040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448398113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448431015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448466063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448491096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448498011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448498964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448519945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448542118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448580980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448582888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448618889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448662043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448698044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448699951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448726892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448729992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448733091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448736906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448765039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448788881 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448811054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448812962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448818922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448853970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448892117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448892117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448913097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448930979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.448945045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.448967934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449001074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449002028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449035883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449070930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449064016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449105024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449146986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449184895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449201107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449215889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449218035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449232101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449244022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449245930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449253082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449265003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449285984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449323893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.449523926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.449528933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.518332958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518354893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518369913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518384933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518400908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518421888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518457890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518465042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.518481016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.518506050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518526077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.518557072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.518726110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519428015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519450903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519469976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519488096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519505978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519524097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519539118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519552946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519567013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519583941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519615889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519628048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519635916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519645929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519655943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519664049 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519675016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519690037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519697905 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519707918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519726038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519745111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519752026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519757986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519762039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519781113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519798040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519820929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519834995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519840002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519856930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519860983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519864082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519876957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519880056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519896030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519913912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519922018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519927979 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.519932032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519949913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519963980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519982100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519998074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.519999027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520004988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520009041 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520011902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520015955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.520034075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.520055056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.520073891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.520091057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.520095110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520101070 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520103931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520108938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.520128012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.520144939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.520172119 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520176888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520179987 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.520251989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.521158934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.521177053 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.521193027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.521212101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.521235943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.521265030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.521270037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.539279938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588145971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588203907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588229895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588253021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588274956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588295937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588318110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588341951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588363886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588382959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588387966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588398933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588407993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588418007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588427067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588434935 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588449955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588464975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588465929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588479996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588495016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588509083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588512897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588514090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588535070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588558912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588581085 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588581085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588593006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588602066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588624954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588650942 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588655949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588673115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588690042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588690042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588705063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.588820934 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.588828087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589637041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589656115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589672089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589688063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589703083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589718103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589732885 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589751005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589756966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589766026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589767933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589770079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589782953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589797974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589813948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589828968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589837074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589840889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589843035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589858055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589875937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589891911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589906931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589921951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589936972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589936972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589948893 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589951992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.589958906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589973927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.589987993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.590020895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.590027094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.590029955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.590647936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608310938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608344078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608376026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608405113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608431101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608458042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608485937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608488083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608503103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608505964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608511925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608541012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608566999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608567953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608572006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608601093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608632088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608659983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608684063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608688116 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608694077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608707905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608733892 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.608772039 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608778000 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608781099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.608850002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.609020948 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.657633066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657665014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657691956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657715082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657737017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657759905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657783031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657797098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657815933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657838106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657860041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657881021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657886982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.657906055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.657917976 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.657924891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.657927036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.657929897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.658083916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.658107042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.658138037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.658158064 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.658205032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.658232927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.658282995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.658304930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.658309937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.658318043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659034967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659061909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659085035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659111977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659147978 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659166098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659178972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659183025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659188986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659209013 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659209967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659230947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659251928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659272909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659296036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659317017 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659320116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659322977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659326077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659343004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659356117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659365892 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659388065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659400940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659406900 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659410000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659430027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659488916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659503937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659508944 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659512043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659533978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659535885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659555912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659609079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659631014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659635067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659674883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659698009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659720898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659742117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659764051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659787893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659809113 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659811020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659813881 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659818888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659832954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659836054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659854889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659876108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659898996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659904957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659909010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.659923077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659944057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659966946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.659998894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660017967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660052061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660057068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660131931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660156965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660178900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660201073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660223007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660244942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660248995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660267115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660270929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660284042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660289049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660310984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660335064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660347939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660357952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660375118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660398006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660399914 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660404921 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660408020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660420895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660446882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660469055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660490036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660494089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660497904 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660501003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660514116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660522938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660536051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660557985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660578966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660588026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660593987 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660598040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660602093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660621881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660645962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660667896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660689116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660686970 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660706043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660711050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660736084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660737991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660742044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660756111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660759926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660780907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660804033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660797119 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660814047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660826921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660849094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660856009 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660861015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660870075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660872936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660892010 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660917044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660921097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660940886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660960913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660962105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660975933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660979033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660981894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.660984039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.660998106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661005974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661027908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661048889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661071062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661096096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661103964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661108971 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661113024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661118984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661139965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661159992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661163092 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661170959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661185980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661207914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661227942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661250114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661251068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661256075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661257982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661276102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661298990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661319971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661330938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661336899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661343098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661354065 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661359072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661365986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661386967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661408901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661417007 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661422968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661431074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661456108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661478996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661487103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661490917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661493063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661499977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661509037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661523104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661525011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661545992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661559105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661566973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661588907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661611080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661634922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661653996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661659002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661659956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661663055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661680937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661704063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661720991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661745071 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661748886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661755085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661757946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661768913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661791086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661812067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661834955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661885023 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661900043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661901951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661904097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661922932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661942959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661946058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.661967993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.661990881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662013054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662035942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662058115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662060022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662065983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662079096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662080050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662102938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662125111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662126064 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662130117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662148952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662172079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662203074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662204981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662210941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662214994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662228107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662236929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662252903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662252903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662276030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662277937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662297010 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662318945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662339926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662362099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662363052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662367105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662370920 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662373066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662395954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662421942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662445068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662467003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662488937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662508011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662509918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662513971 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662532091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662554026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662575960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662600040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662600040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662607908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662610054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662625074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662628889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662651062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662683964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662708044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662708998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662714005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662728071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662731886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662753105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662775040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662797928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662805080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662810087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662812948 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662818909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662842035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662842035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662864923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662888050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662909985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662910938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662916899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662919998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.662933111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662955046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.662976980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663017035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663024902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663029909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663039923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663044930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663063049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663084984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663085938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663108110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663130999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663136005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663141966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663161039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663182020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663186073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663192034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663204908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663213015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663228035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663249016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663250923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663261890 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663273096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663299084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663321972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663330078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663336039 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663345098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663356066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663367033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663394928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663415909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663439035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663445950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663450956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663460016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663467884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663470984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663484097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663486958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663505077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663527012 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663531065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663552046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663556099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663558960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663573027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663578987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663600922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663623095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663645983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663645983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663650036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663661003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663667917 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663690090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663690090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663712978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663734913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663737059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663759947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663780928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663789034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663799047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663804054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663826942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663847923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663858891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663870096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663871050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663892031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663917065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663938999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663958073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663959980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.663964033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663968086 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.663983107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664004087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664026022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664026022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664035082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664048910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664069891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664084911 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664094925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664102077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664119005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664140940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664160967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664161921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664165020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664184093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664201975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664206028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664228916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664249897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664275885 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664293051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664299011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664299011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664303064 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664321899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664344072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664362907 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664366007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664366961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664381981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664387941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664410114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664416075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664422035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664432049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664434910 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664455891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664479017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664499998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664499998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664504051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664506912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664521933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664545059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664562941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664566040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664566994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664572001 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664587021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664587975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664611101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664624929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664629936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664635897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664660931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664681911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664695024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664699078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664700985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664705038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664726973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.664747953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664752960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.664875984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.671593904 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.677623987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677659035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677680969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677705050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677727938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677755117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677778006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677799940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677822113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677844048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677856922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.677865982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677870989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.677875042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.677885056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.677889109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677911997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677937984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677959919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.677962065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.677964926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.677983046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.678005934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.678035975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.678040028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.678041935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.678138971 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.726874113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.726902962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.726928949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.726953030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.726974964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.726995945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727018118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727040052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727056026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727061987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727082014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727083921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727088928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727109909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727109909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727145910 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727147102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727170944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727193117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727215052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727222919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727236986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727271080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727276087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727283001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727296114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727302074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727304935 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727304935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727327108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727349997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.727397919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727402925 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.727405071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728332996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728358030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728379965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728401899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728456974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728468895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728676081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728703022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728725910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728748083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728770018 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728790998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728811979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728813887 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728822947 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728841066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728883028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728888035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728910923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728957891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728959084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.728976011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.728982925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729005098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729027987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729053020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.729057074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.729073048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729079008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.729110956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729131937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729156971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729170084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.729180098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729198933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.729201078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729212046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.729223013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729243994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.729258060 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.729379892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733617067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733649015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733666897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733690023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733712912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733736992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733762980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733787060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733789921 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733808994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733810902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733814955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733818054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733831882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733839989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733849049 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733855009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733875990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733899117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733922005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733922958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733941078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.733947039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733971119 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.733992100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734010935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734015942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734019995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734038115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734039068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734061956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734070063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734083891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734105110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734129906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734132051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734138966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734143019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734153032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734174967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734179020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734196901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734203100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734220028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734221935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734237909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734260082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734281063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734304905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734327078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734328985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734337091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734344959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734349012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734364986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734369993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734370947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734395981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734412909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734421015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734443903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734464884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734488010 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734512091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734510899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734519958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734523058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734534025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734555960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734572887 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734577894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734595060 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734599113 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734602928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734626055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734644890 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734651089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734674931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734674931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734699965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734723091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734740973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734762907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734776974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734783888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734786034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734802961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734806061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734810114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734822989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734832048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734853983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734877110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734894037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734900951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734900951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734925985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734946966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734968901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.734970093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734988928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.734992027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735011101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735013962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735035896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735049963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735055923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735057116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735083103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735101938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735129118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735141993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735153913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735165119 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735188961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735198021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735212088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735236883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735251904 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735260010 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735291958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735312939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735315084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735322952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735327959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735333920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735356092 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735378981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735384941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735392094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735400915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735410929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735425949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735439062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735445023 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735450029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735472918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735475063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735496044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735518932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735527992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735541105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735553980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735558987 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735563040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735563993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735586882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735610962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735635042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735644102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735652924 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735656977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735656977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735680103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735702038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735723019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735734940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735740900 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735744953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735747099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735748053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735769033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735781908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735786915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735795975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735820055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735842943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735853910 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735865116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735883951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735888004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735889912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735909939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735930920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735944033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735953093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735979080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.735980034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.735986948 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736002922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736012936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736018896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736023903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736023903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736047983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736068964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736071110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736080885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736087084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736090899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736109972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736112118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736134052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736146927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736157894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736159086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736181974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736200094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736205101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736207008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736221075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736227989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736249924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736249924 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736270905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736273050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736293077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736314058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736339092 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736350060 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736361027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736362934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736368895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736385107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736394882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736401081 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736404896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736433029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736447096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736455917 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736476898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736500025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736521006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736545086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736568928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736573935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736584902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736591101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736612082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736612082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736618996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736624002 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736628056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736634970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736656904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736668110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736679077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736705065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736728907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736752033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736759901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736769915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736773968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736776114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736783981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736797094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736807108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736819029 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736820936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736843109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736861944 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736865044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736887932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736891985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736901045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.736912966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736938000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736959934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736982107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.736993074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737001896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737003088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737025023 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737025976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737030983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737039089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737049103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737067938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737071037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737092972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737099886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737119913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737123966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737145901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737166882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737176895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737189054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737190008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737194061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737221956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737224102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737230062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737245083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737267017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737283945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737288952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737312078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737318039 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737333059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737359047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737380981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737385035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737394094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737399101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737402916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737425089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737426996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737448931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737469912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737487078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737493038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737497091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737503052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737514973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737550974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737557888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737560034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737561941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737582922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737603903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737607002 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737629890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737663984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737673044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737679005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737670898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737732887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737756014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737777948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737801075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737814903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737823009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737827063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737842083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737857103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737859964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737884998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737909079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737931013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737936020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737946033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737951040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737953901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737961054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737977028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.737994909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.737999916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738002062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738022089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738022089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738044977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738055944 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738063097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738070965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738084078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738095045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738117933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738140106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738162994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738173962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738185883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738209009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738221884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738228083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738231897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738231897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738256931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738257885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738281012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738302946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738316059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738326073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738348007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738348961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738358974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738369942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738392115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738393068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738415956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738440037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738440037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738449097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738455057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738462925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738486052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738488913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738508940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738532066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738554955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738576889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738576889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738590956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738599062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.738616943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738620996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738624096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.738632917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.740534067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.740561008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.740582943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.740731955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.740765095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.746896029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.746927023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.746948004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.746970892 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.746990919 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747014046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747037888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747049093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747057915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747064114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747067928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747080088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747082949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747097015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747102976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747140884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747164011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747185946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747195959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747208118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747231960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747253895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747270107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747275114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.747287035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747332096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.747338057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796308041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796421051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796462059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796480894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796519995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796556950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796562910 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796580076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796614885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796617985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796694994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796735048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796772003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796772957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796797991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796811104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796849966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796863079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796901941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796924114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796942949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796964884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.796967030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796972990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796976089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.796998978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797019958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797041893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797044992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.797060013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797082901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797106981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797122955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.797154903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.797260046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.797759056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797785997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797808886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797832012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797852993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797874928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797884941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.797895908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.797897100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.797914028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.797930956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798001051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798175097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798197985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798218966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798238993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798259020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798280001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798290014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798300982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798309088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798321009 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798326015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798347950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798368931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798369884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798377991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798389912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798409939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798432112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.798468113 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798484087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.798609018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807595015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807622910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807647943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807672024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807693958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807698965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807713985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807715893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807738066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807755947 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807761908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807775021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807782888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807806969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807828903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807851076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807872057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807893991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807898998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807905912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807912111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807915926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807931900 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.807936907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807959080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.807981968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808005095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808005095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808008909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808027029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808048964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808072090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808093071 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808115005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808135033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808159113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808175087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808191061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808196068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808212042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808217049 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808217049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808242083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808242083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808264971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808270931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808286905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808309078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808329105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808351040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808372021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808378935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808383942 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808393002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808402061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808409929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808417082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808439970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808460951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808461905 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808482885 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808504105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808525085 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808545113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808566093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808567047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808574915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808592081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808600903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808614969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808615923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808629990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808648109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808671951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808693886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808705091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808712006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808716059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808737040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808758020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808772087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808779955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808793068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808801889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808824062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808839083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808851004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808866024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.808873892 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808895111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808917046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808938026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808959007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.808979034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809000969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809005976 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809020996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809025049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809026003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809030056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809035063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809046984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809067011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809089899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809111118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809129000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809151888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809170008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809185028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809191942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809197903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809214115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809237003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809243917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809248924 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809258938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809281111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809302092 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809323072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809343100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809355974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809364080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809365034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809386969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809411049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809412956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809433937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809442997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809456110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809478045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809495926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809500933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809521914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809525967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809544086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809566021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809582949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809588909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809588909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809612036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809632063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809654951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809664965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809675932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809683084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809699059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809706926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809746981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809760094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809772015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809775114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809793949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809818983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809832096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809839010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809843063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809864044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809884071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809885979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809889078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809907913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809917927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809928894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809952021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809972048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.809978008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.809995890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810018063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810039043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810060024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810081005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810091019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810098886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810101986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810116053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810122013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810143948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810151100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810154915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810168028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810189962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810209990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810231924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810251951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810255051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810261011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810264111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810271978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810293913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810307980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810313940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810316086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810340881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810363054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810384035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810405016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810426950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810430050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810435057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810436964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810446978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810468912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810489893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810497999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810506105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810513973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810537100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810556889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810578108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810599089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810609102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810615063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810617924 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810620070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810641050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810662985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810667992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810687065 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810688019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810710907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810731888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810753107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810758114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810761929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810774088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810795069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.810848951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.810854912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.816338062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.816371918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.816395998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.816416979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:30.816502094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.816531897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:30.954607010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024178982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024204969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024221897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024244070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024264097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024281979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024298906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024317026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024333000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024350882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024368048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024389982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024409056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024425983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024442911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024441957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024461031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024462938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024466991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024471045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024472952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024478912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024485111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024496078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024513006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024533033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024552107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024568081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024569988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024574995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024578094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024585009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024602890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024636030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024656057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024658918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024658918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024662018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024682045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024710894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024724007 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024728060 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024729967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024739027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024763107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024786949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024801970 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024810076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024810076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024812937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024833918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024857044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024877071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024878979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024883032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024885893 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024907112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024930954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024940968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024945021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024946928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024947882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.024970055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.024992943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025013924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025036097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025058031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025083065 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025085926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025089025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025098085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025111914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025134087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025156975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025180101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025185108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025202036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025202990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025207043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025209904 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025213003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025226116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025228977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025249004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025276899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025300980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025305033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025309086 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025311947 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025324106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025346041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025365114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025367975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025371075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025373936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025389910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025412083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025415897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025434017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025461912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025465965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025486946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025510073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025518894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025532007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025533915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025537014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025554895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025588036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025593042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025614023 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025619030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025635004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025660038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025682926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025706053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025712013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025712967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025744915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025753021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025758982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025783062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025811911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025836945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025865078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025896072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025902987 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025928020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025948048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025958061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.025958061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025965929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025973082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025979996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.025990963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026027918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026056051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026077032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026098967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026120901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026127100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026143074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026153088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026161909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026165962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026190042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026205063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026211977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026216984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026221037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026222944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026225090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026256084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026288033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026319981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026324034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026339054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026344061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026349068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026356936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026365995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026382923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026390076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026412964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026439905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026465893 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026468039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026477098 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026485920 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026499987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026501894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026515007 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026530981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026554108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026576996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026601076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026623011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026650906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026673079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026678085 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026685953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026693106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026700020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026700974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026724100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026747942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026757002 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026767969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026768923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026777983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026787043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026792049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026814938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026827097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026835918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026843071 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026868105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026890039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026912928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026926994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026936054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026937962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026946068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.026957989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.026979923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027003050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027012110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027026892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027029991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027035952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027045965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027055025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027076006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027089119 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027097940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027098894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027137995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027146101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027152061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027177095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027198076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027221918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027256012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027276993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027303934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027304888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027323961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027329922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027333975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027343035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027353048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027357101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027364969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027375937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027398109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027410030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027422905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027447939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027456045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027461052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027467012 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027489901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027489901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027524948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027556896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027559042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027590990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027616024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027625084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027631044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027654886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027667046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027678967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027702093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027724981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027751923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027753115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027762890 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027767897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027776957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027800083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027822018 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027833939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027843952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027843952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027867079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027889967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027911901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027930975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027940989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027947903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027949095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027955055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027962923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.027976036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.027997971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028021097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028043032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028064966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028088093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028095007 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028110027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028110027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028124094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028132915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028136969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028141022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028156996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028162956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028181076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028186083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028208971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028232098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028254032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028263092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028275967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028275967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028290033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028295040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028299093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028301954 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028326988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028328896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028352022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028373957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028395891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028412104 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028419971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028426886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028438091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028440952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028446913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028464079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028480053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028485060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028513908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028513908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028539896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028563976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028588057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028611898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028618097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028633118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028635025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028641939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028650045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028659105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028682947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028707981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028711081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028716087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028738022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028752089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028762102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028785944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028830051 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028841019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028841972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028865099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028887033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028891087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028903008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028909922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028911114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028918028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028938055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028955936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.028961897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.028985977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029009104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029031992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029031992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029042006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029048920 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029053926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029055119 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029062033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029076099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029098034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029098988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029113054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029128075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029154062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029175997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029189110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029200077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029201031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029208899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029222965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029243946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029267073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029269934 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029280901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029288054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029288054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029316902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029341936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029362917 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029365063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029377937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029386044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029387951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029397011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029405117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029408932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029422998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029431105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029453039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029475927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029504061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029527903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029532909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029544115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029550076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029551029 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029572964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029594898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029616117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029618025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029629946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029639006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029639006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029649019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029660940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029689074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029710054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029714108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029721022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029728889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029736996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029767036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029772997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029777050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029798985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029822111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029845953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029858112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029867887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029874086 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029884100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029890060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029897928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029907942 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029913902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029916048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.029936075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029963970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029988050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.029989004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030002117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030010939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030014992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030023098 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030031919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030033112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030056953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030078888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030102015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030123949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030124903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030133963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030142069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030152082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030177116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030199051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030205965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030220985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030221939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030230999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030245066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030267000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030277967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030289888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030289888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030297995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030313015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030339956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030352116 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030361891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030364990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030369997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030386925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030411005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030421972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030432940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030433893 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030442953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030455112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030478001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030489922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030499935 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030500889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030509949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030527115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030553102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030559063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030566931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030574083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030596972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030618906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030641079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030663013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030675888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030685902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030688047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030699968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030708075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030714035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030739069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030762911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030776024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030786037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030786991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030791998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030808926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.030879021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030891895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.030901909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.099951982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100023031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100076914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100126028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100155115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100178003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100178957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100183010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100193024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100230932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100284100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100333929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100341082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100347996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100351095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100390911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100445032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100449085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100469112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100496054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100545883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100594997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100645065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100687027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100696087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100697041 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100702047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100706100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100750923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100805998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100861073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100878954 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100886106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100905895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.100910902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.100961924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101013899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101063013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101063013 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101098061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101104975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101114035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101161957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101165056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101222992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101275921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101290941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101299047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101325989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101326942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101373911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101408005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101440907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101449966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101454973 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101458073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101474047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101509094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101550102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101572990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101577997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101582050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101588011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101622105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101655960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101666927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101671934 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101675034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101691961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101726055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101759911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101768970 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101773977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101777077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101794004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101835966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101874113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101886034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101892948 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101897001 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101907969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101942062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101977110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.101988077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101993084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.101996899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102009058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102045059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102077961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102087975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102092028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102094889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102119923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102158070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102191925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102205038 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102210045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102214098 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102226019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102260113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102293015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102303028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102308035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102309942 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102327108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102360964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102384090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102401972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102402925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102407932 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102442026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102474928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102485895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102490902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102509022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102544069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102576971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102588892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102593899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102596998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102615118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102657080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102706909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102710009 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102718115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102721930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102745056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102780104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102816105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102826118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102830887 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102833986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102849960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102881908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102916002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102926970 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102931976 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102933884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.102952003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.102994919 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103032112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103065968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103082895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103087902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103091955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103101015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103149891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103173971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103214025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103256941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103276968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103295088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103296995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103329897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103365898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103398085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103399992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103403091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103406906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103432894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103466988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103482962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103488922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103492022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103501081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103544950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103583097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103593111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103600025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103604078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103615999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103651047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103671074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103674889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103684902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103718996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103753090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103759050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103763103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103765965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103786945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103830099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103867054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103873968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103879929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103883982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103899956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103934050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103967905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.103972912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103977919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.103981018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104000092 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104033947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104068041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104074955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104079962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104084015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104110003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104149103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104182005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104196072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104201078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104203939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104217052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104252100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104285002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104304075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104309082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104311943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104317904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104351044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.104398966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104404926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.104408979 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.173444986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173516989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173573971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173629045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173646927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.173670053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.173671007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173711061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173716068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.173785925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173837900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173877954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173898935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.173907995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.173912048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.173917055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.173921108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.173964977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174007893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174035072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174043894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174057961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174071074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174101114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174153090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174206972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174247026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174283028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174285889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174328089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174370050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174406052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174443007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174463034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174469948 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174470901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174479961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174516916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174554110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174561024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174566984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174571037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174590111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174635887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174647093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174652100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174681902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174726963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174765110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174802065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174812078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174818993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174823046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174849987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174865961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174926996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174971104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.174983978 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.174988031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175019979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175069094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175112009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175132990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175152063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175189018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175194025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175196886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175245047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175285101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175323009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175328970 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175354004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175358057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175359964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175415993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175416946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175422907 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175471067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175471067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175524950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175537109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175596952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175653934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175704002 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175713062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175713062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175717115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175770044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175770044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175812006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175844908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175848007 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175853968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175909042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175946951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175950050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.175956964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.175998926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176028967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176033020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176034927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176073074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176122904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176125050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176130056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176173925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176196098 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176227093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176244974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176270962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176318884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176352978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176374912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176390886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176403999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176429033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176465034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176465988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176471949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176511049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176553011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176589966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176623106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176630020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176640034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176646948 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176678896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176697969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176717043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176754951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176770926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176778078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176793098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176840067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176866055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176882029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176887989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176919937 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176934958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176947117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.176959991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.176980019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177020073 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177063942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177102089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177117109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177123070 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177125931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177161932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177222967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177264929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177301884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177308083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177315950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177316904 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177362919 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177407026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177463055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177495956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177504063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177508116 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177510023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177558899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177577019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177603006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177627087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177678108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177727938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177731037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177771091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177778959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177828074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177876949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.177885056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177891016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177894115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.177927971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.178047895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.178055048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.215384007 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.247328997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.247361898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.247383118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.247405052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.247431993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.247457027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.247478962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.247534990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.247567892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.247656107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284564972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284598112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284619093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284640074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284661055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284661055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284683943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284712076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284713030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284734964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284756899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284779072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284794092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284799099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284801006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284822941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284843922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284864902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284888029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284909964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284913063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284917116 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284919977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284931898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284940958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284953117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284974098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.284986973 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.284993887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285015106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285016060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285037994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285060883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285084963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285103083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285106897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285119057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285135984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285152912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285176039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285177946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285187006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285200119 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285219908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285223007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285244942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285263062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285284042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285284996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285303116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285320997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285324097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285345078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285347939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285366058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285389900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285413027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285415888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285434008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285434961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285438061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285455942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285479069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285499096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285520077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285540104 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285541058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285558939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285562992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285564899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285566092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285588026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285612106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285633087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285645008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285657883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285679102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285681009 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285686016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285701036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285722017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285746098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285754919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285768986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285789967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285789967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285810947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285831928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285844088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285849094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285851955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285872936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285892963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285906076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285917044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285939932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285960913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285967112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285973072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.285983086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.285996914 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286004066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286025047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286041975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286066055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286081076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286096096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286112070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286115885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286132097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286156893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286179066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286201000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286218882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286225080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286245108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286267996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286289930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286313057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286320925 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286334038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286356926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286356926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286379099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286400080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286400080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286422014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286437035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286446095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286468029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286488056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286513090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286518097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286520958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286534071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286539078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286561012 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286565065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286587954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286607981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286628962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286633968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286647081 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286650896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286650896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286672115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286694050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286715031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286739111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286761999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286772013 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286777973 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286781073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286782980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286804914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286825895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286845922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286856890 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286874056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286889076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286892891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286895037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286920071 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286936998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286957979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286969900 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286978960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.286982059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.286999941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287038088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287041903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287067890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287091017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287107944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287107944 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287137985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287157059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287179947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287190914 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287201881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287223101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287242889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287254095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287259102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287265062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287285089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287302017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287318945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287336111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287352085 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287368059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287385941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287399054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287420988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287441969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287450075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287518024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287539959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287547112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287552118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287559032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287580013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287599087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287600040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287621021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287641048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287648916 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287662029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287686110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287709951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287710905 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287728071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287730932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287731886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287753105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287774086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287795067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287811995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287815094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287834883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287858009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287869930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287879944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287899971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287913084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287923098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287931919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.287945986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287966013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.287986994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288007975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288018942 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288023949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288031101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288039923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288053036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288088083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288093090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288115025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288136005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288149118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288157940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288172960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288177967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288243055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288250923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288255930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288263083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288285017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288306952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288309097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288328886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288340092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288352966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288374901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288395882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288417101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288438082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288448095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288454056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288456917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288459063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288479090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288501978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288522959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288526058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288528919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288548946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288585901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288646936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288656950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288665056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288669109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288671017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288692951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288713932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288734913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288747072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288757086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288774014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288779020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288800955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288821936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288846016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288867950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288868904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288875103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288877964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288889885 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288911104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288932085 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288954020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288973093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288974047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.288985014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.288995028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.289134979 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.289165974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.289171934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.289191961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.290159941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.316549063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.316584110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.316606998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.316629887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.316649914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.316673040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.316708088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.316737890 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.316741943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.342869043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.356055975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356095076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356121063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356307030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356334925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356355906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356378078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356400013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356420994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356441975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356448889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.356463909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356466055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.356470108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.356472969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.356484890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356534004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.356540918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.356547117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.356616020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.357160091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357189894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357249975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357274055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357295036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357311964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.357346058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.357350111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.357352972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.357733965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357760906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357780933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357851028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357872009 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.357873917 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.357886076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358223915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358242035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358453989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358490944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358515978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358541965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358567953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358592987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358618021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358635902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358644962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358645916 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358649015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358675957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358676910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358835936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358879089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358892918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358916998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.358930111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.358990908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359083891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359126091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359154940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359193087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359210014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359234095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359237909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359240055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359261036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359373093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359395027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359441042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359482050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359536886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359548092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359555006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359558105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359559059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359596014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359622955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.359838009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359868050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359894991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359937906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.359981060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360002995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360027075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360029936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360119104 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360219002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360260963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360301971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360331059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360337019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360344887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360384941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360552073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360605001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360641956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360682964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360701084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360707998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360709906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360724926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360753059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360764980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360918045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.360935926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.360953093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361012936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361047029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361054897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361063004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361076117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361100912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361176968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361207008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361241102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361247063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361274958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361309052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361341953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361354113 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361357927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361360073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361481905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361515999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361547947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361583948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361593962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361607075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361618996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361624002 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361653090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361679077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361682892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361691952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361726999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361759901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361778021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361784935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361787081 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361793041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361826897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361849070 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361852884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361864090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361872911 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361897945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.361948013 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361953020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.361974955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362051964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362128019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362162113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362195015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362231970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362271070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362307072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362309933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362313032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362317085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362319946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362351894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362387896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362405062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362410069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362427950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362463951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362498999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362519026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362526894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362530947 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362539053 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362577915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362612009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362643003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362648964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362652063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362814903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362850904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362888098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362921000 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362926960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362927914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.362930059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362932920 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.362968922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363004923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363022089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363025904 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363070011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363149881 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363152981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363156080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363188982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363225937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363228083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363266945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363307953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363339901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363353014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363346100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363363028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363390923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363425970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363451004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363457918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363460064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363461018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363464117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363492966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363518000 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363527060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363560915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363576889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363583088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363599062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363635063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363641024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363646984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363668919 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363702059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363720894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363737106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363725901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363766909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363773108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363781929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363809109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363817930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363842964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363881111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363914967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363941908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363946915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363949060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363950014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363982916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.363993883 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.363998890 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364015102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364048004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364064932 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364082098 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364082098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364084005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364115953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364152908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364191055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364201069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364222050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364226103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364226103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364228964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364260912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364295006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364322901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364326954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364341021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364345074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364360094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364392996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364429951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364434958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364439011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364442110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364464045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364496946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364531040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364540100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364545107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364547968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364564896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364597082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364629984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364643097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364646912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364650011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364665031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364706993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364748001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364751101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364758015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364759922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364788055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364826918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364865065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364888906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364895105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364902973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364943027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.364959002 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.364983082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365027905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365031004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365068913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365103006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365115881 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365123034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365125895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365139008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365180016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365220070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365221024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365250111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365288019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365298986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365315914 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365319014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365329027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365370035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365387917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365395069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365411043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365438938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365452051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365493059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365508080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365521908 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365533113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365569115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365602016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365619898 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365626097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365628958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365636110 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365669966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365703106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365724087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365730047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365731955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365737915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365770102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365807056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365817070 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365823030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365824938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365842104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365875006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365911961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365931034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365935087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365937948 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.365946054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.365979910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.366013050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.366029024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.366033077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.366035938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.366049051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.366063118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.366087914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.366123915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.366158009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.366159916 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.366164923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.366168022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.366200924 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.385670900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.385710001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.385735989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.385760069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.385761976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.385776043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.385788918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.385834932 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.385840893 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.411937952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412000895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412025928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412049055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412079096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.412081003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412097931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.412116051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412146091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412169933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412192106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412214041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.412226915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.412234068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.412236929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.412244081 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.412292957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425632954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425669909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425700903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425729990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425755978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425769091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425780058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425792933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425796986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425806999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425832987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425841093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425847054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425863981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425894022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425914049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425934076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425940990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425947905 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425951004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.425961018 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425981045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.425987959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.426039934 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.426045895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.426269054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.426302910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.426327944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.426352978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.426378965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.426389933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.426429987 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.426434040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.426436901 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.426440001 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.427222967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427263021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427294970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427324057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427330971 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.427352905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427474976 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.427490950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.427506924 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.427771091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427802086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427831888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427860022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427891016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.427897930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427901983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.427931070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427953959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.427961111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.427990913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428004980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428008080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428024054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428066969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428162098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428183079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428205013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428206921 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428210974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428220034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428237915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428267956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428297043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428359032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428366899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428369999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428534985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428565025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428594112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428628922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428649902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428661108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428689003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428721905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428733110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428822994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.428894997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428931952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.428968906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429003954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429017067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429024935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429028034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429032087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429073095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429086924 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429641962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429672956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429699898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429723024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429753065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429781914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429783106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429794073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429804087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429826975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429835081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429863930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429874897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429894924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429923058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.429924965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429943085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429945946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.429972887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.430010080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.430021048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.430027008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.430088043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.430197001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.430226088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.430248022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.430376053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.430382967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.430388927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.430433035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.430571079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.430618048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431195974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431266069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431318998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431366920 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431372881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431377888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431381941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431413889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431422949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431560993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431610107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431619883 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431638956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431698084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431749105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431797028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431807041 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431811094 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431843996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431917906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.431967974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.431967974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432002068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432018995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432066917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432066917 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432075024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432123899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432180882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432200909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432215929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432238102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432291031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432307005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432313919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432343960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432352066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432385921 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.432394981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.432463884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435172081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435260057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435278893 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435313940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435333967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435364962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435421944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435471058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435487986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435503960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435511112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435523987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435585976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435648918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435657024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435667992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435672045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435700893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435758114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435759068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435769081 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435806990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435853958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435856104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435864925 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435905933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.435919046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.435956955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436005116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436067104 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436119080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436146021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436161041 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436167955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436171055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436220884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436224937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436269045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436317921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436377048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436387062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436414003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436465025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436518908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436568975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436573029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436589956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436623096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436686993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436695099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436753035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436763048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436803102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436908007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436925888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.436959982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.436992884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437015057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437022924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437052965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437084913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437103033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437114954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437114954 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437122107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437128067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437149048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437151909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437179089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437191963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437208891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437227011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437238932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437269926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437298059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437319994 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437328100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437328100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437334061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437370062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437402964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437417984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437429905 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437433958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437438011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437443018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437463999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437483072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437494993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437527895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437542915 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437551975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437556982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437557936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437587023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437618971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437652111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437681913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437684059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437694073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437699080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437712908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437742949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437747955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437777042 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437791109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437799931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437808990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437838078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437870979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437897921 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437903881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437906981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437911987 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437936068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437964916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.437984943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437997103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.437999964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438019991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438024998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438030958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438046932 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438059092 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438106060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438139915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438162088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438169003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438172102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438178062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438199043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438230038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438251019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438257933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438262939 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438270092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438275099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438287973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438318014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438340902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438352108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438354969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438363075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438395977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438404083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438436031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438467979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438486099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438498020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438498020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438505888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438534021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438570023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438601017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438604116 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438611031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438616037 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438631058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438659906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438689947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438693047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438704967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438725948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438729048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438735008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438755989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438766003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438786030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438818932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438852072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438867092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438878059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438882113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438884020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438889980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438915014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438946009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.438961983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438971043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.438976049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.439006090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.439032078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.439053059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.439059973 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.454843044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.454878092 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.454906940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.454932928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.454943895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.454958916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.454978943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.455001116 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.455018997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.455028057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.455037117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.455048084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.455050945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.455059052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.455060959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.455074072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.455094099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.455101013 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481344938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481379032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481403112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481427908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481452942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481476068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481498957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481523037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481539965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481544971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481554031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481556892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481559038 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481560946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481570005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481592894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481618881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481622934 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481626034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481643915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.481695890 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481700897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.481703997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495089054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495127916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495153904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495161057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495177031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495193005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495198965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495202065 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495208025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495228052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495264053 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495287895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495302916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495311975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495316982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495317936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495333910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495352030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495368004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495376110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495419979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495435953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495450974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495465040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495476961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495480061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495496988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495498896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.495536089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.495541096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.496438026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.496464014 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.496485949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.496509075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.496515989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.496531963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.496536016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.496578932 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.496592045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497123003 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497168064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497200012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497229099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497256994 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497273922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497302055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497306108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497312069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497492075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497528076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497556925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497584105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497607946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497613907 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497613907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497616053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497644901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497672081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497697115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497709036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497725964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497728109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497756004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.497764111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497767925 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.497848034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.498064995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498096943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498126984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498158932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498162031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.498171091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.498188019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498214960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498241901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498269081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498279095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.498282909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.498291016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.498291969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.498338938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.498956919 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.498989105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499017000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499043941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499066114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499072075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499073029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499084949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499100924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499145031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499171019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499174118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499181032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499193907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499214888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499234915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499253035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499264956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499269962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499273062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499291897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499332905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499383926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499388933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499391079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499725103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499751091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499771118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499790907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499814987 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.499841928 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499851942 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499855995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.499859095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.501631021 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.501661062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.501688957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.501712084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.501737118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.501827955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.501843929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.508162975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.508205891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.508236885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.508368969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.620158911 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689304113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689354897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689388990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689440966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689493895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689543009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689544916 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689548969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689594030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689646006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689692020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689697981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689702034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689718008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689769030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689825058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689888000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689924955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689933062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689940929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.689946890 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689980984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.689991951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690030098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690068960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690104961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690110922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690118074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690121889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690143108 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690180063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690200090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690242052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690248966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690253973 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690289974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690304041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690360069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690401077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690464973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690484047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690490961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690495014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690510035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690546989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690551043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690557003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690583944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690623045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690669060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690700054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690707922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690710068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690730095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690768003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690777063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690843105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690897942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.690900087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.690948963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691004038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691035986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691044092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691061020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691104889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691212893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691272020 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691322088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691328049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691332102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691334963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691390991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691437960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691445112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691477060 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691536903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691592932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691621065 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691626072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691653013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691704035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691704988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691709995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691771030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691831112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691889048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.691894054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691901922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691905022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.691948891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692023993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692034006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692040920 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692081928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692135096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692188978 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692234993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692240000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692245007 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692248106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692326069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692370892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692378998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692384958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692424059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692478895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692517996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692523003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692565918 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692621946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692677975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692724943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692729950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692744970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692786932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692842007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692877054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.692907095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.692965984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693001032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693005085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693006992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693025112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693089008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693136930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693154097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693160057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693196058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693203926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693250895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693295002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693311930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693320036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693356037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693393946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693407059 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693423033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693481922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693535089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693540096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693543911 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693634033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693648100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693691969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693749905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693808079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693814993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693820953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693823099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693864107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693906069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693911076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.693918943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.693981886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694041967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694086075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694088936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694091082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694097996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694170952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694173098 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694236040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694293022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694309950 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694314003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694334984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694371939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694408894 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694410086 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694413900 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694416046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694454908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694495916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694506884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694513083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694534063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694571018 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694608927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694611073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694614887 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694617033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694644928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694678068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694681883 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694681883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694719076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694755077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694757938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694766998 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694808960 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694860935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694864035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694866896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694900036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694905043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694937944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.694971085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694974899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.694976091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695012093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695044041 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695049047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695050955 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695086956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695161104 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695168972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695218086 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695230007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695278883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695313931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695319891 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695321083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695358992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695393085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695395947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695400000 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695434093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695435047 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695471048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695492983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695508957 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695545912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695547104 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695553064 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695583105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695594072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695636034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695672989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695710897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695714951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695739985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695760965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695764065 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695770025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695811033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695847988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695847988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695853949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695885897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695887089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695923090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.695924997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.695972919 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696014881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696038961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696044922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696053028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696089029 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696093082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696091890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696130991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696166992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696166992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696187019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696202040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696204901 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696240902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696274996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696280956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696288109 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696331024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696363926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696367025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696369886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696405888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696409941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696444035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696480036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696480036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696485996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696538925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696577072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696577072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696583986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696624041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696666002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696703911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696706057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696712971 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696742058 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696779013 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696780920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696783066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696816921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696852922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696855068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696860075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696893930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696932077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696938038 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.696940899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.696981907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697019100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697021961 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697030067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697057962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697097063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697133064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697144985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697154045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697156906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697174072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697211981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697212934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697220087 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697261095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697304010 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697340965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697345972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697352886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697355986 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697379112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697417974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697453022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697463989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697470903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697474003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697500944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697546005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697546959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697550058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697594881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697637081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697676897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697679043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697683096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697685957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697732925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697772980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697812080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697812080 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697832108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697835922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697848082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697873116 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697885036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697921038 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697921991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.697925091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.697957993 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767087936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767179012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767237902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767323017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767360926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767400980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767417908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767425060 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767433882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767441034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767477989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767517090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767533064 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767544031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767579079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767617941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767652988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767671108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767683983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767690897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767697096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767710924 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767756939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767803907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767822027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767834902 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767863989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767873049 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.767915964 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767955065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.767987967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768007040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768050909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768089056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768126011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768145084 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768160105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768168926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768176079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768188000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768248081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768284082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768313885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768326044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768332958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768342972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768392086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768429995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768461943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768475056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768481016 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768481970 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768529892 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768573999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768582106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768627882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768666029 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768712044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768733025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768744946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768753052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768762112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768778086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768831968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768871069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768909931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768946886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.768970966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768986940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768996954 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.768999100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769006014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769048929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769098043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769109964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769123077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769160986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769200087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769237995 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769256115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769269943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769278049 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769294977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769339085 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769376040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769419909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769459963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769474983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769490957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769506931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769552946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769591093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769610882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769654989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769701958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769737959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769758940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769772053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769778967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769785881 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769797087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769853115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769891977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769927979 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769942045 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.769949913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769958973 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769998074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.769999981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770055056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770097971 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770107031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770118952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770153046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770193100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770210981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770226955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770235062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770252943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770296097 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770334959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770349979 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770363092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770395041 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770401001 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770456076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770498037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770519972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770551920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770567894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770579100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770610094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770651102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770667076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770678997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770706892 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770746946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770786047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770802021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770817041 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770824909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770833015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770848989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770894051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770930052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.770951033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770962000 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.770987988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771018982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771033049 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771043062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771086931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771158934 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771161079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771184921 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771214008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771220922 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771275997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771276951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771332979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771353960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771389008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771393061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771440983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771471977 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771493912 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771497011 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771543980 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771581888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771599054 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771610022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771640062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771680117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771728992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771733999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771748066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771756887 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771790028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771827936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771864891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.771892071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771903992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771910906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771918058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.771919012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.772012949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.772051096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.772088051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.772133112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.772146940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.772159100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.772166014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.834165096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.842506886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842552900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842588902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842652082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842690945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842737913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842775106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842775106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.842797995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.842803001 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.842806101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.842812061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842849970 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842886925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842916012 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.842921972 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.842941999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.842981100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843028069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843028069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843033075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843035936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843070030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843107939 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843189001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843192101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843199015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843200922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843231916 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843308926 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843352079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843391895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843399048 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843403101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843441963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843483925 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843508005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843513966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843518019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843522072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843563080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843566895 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843599081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843637943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843650103 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843657017 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843660116 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843691111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843715906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843727112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843775034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843816996 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843828917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843835115 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843838930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.843852997 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843893051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843931913 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.843966961 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844011068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844055891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844093084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844094992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844141006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844182968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844219923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844259024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844295025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844309092 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844325066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844327927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844331026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844333887 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844335079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844356060 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844373941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844392061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844410896 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844456911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844470024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844499111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844502926 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844506979 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844536066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844573975 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844580889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844587088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844611883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844647884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844676018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844686031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844696045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844698906 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844722986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844741106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844778061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844820023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844831944 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844839096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844857931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844867945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844894886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844933033 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.844944954 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844950914 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.844970942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845000982 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845040083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845045090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845077038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845114946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845141888 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845149040 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845150948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845166922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845170975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845189095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845200062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845226049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845271111 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845273972 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845278025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845315933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845351934 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845354080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845371962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845391989 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845406055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845431089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845459938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845493078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845496893 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845535040 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845572948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845601082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845607996 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845609903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845611095 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845645905 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845684052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845699072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845704079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845706940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845721006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845769882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845812082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845832109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845838070 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845840931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845849991 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845889091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845942974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845963955 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845972061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845978022 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.845974922 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.845990896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846015930 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846051931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846069098 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846076012 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846088886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846126080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846162081 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846182108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846188068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846190929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846209049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846250057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846287012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846307039 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846313953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846324921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846317053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846333027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846362114 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846398115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846415043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846421957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846436024 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846472025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846518993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846528053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846534967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846538067 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846561909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846599102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846637011 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846653938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846659899 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846662998 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846673965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846709967 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846749067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846755981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846762896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846765995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846786976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846833944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846874952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846880913 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846887112 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846889973 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.846913099 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846950054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846986055 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.846997023 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847002983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847006083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847023010 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847060919 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847098112 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847103119 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847109079 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847111940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847167015 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847172022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847217083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847258091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847266912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847280979 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847295046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847333908 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847347021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847357035 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847371101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847387075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847405910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847445965 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847481966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847498894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847506046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847508907 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847528934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847569942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847606897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847630024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847644091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847645044 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847667933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847671032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847681046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847717047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847728968 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847735882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847754002 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847793102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847839117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847846031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847852945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847855091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847879887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847917080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847955942 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.847971916 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847979069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847991943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.847991943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848027945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848064899 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848083019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848088980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848090887 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848102093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848149061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848190069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848203897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848208904 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848212004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848225117 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848262072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848299026 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848335028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848367929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848371983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848390102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848392963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848396063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848417044 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.848433018 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.848649025 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.888885021 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.919825077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.919877052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.919913054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.919950962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.919987917 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920030117 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920033932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920048952 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920052052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920073032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920089006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920106888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920180082 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920182943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920185089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920218945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920253038 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920281887 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920285940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920286894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920303106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920320988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920353889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920397043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920408964 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920414925 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920418024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920434952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920469046 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920486927 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920504093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920537949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920571089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920582056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920587063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920588970 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920605898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920609951 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920639992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920681953 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920720100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920721054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920725107 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920730114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920753956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920767069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920790911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920825005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920845985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920850992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920857906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920867920 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.920892000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920933962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920967102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.920996904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921001911 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921008110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921010017 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921024084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921051979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921077967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921078920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921082020 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921106100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921118975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921123028 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921124935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921134949 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921161890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921195984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921207905 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921211004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921212912 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921226025 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921252966 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921277046 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921279907 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921307087 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921334028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921361923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921371937 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921375990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921377897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921389103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921422958 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921452999 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921478033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921482086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921482086 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921509981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921538115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921561003 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921564102 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921566010 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921569109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921580076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921591043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921617985 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921650887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921659946 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921664953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921667099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921681881 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921708107 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921736956 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921741962 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921747923 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921763897 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921791077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921818018 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921828032 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921833992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921838045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921844959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921860933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921880007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921911001 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921920061 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921925068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921927929 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.921937943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921966076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.921992064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922018051 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922044039 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922044992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922050953 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922055006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922072887 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922107935 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922130108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922137976 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922138929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922167063 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922194004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922210932 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922216892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922220945 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922220945 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922246933 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922274113 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922300100 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922301054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922311068 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922314882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922321081 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922334909 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922364950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922391891 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922418118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922440052 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922446012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922470093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922472000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922480106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922487974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922498941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922498941 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922507048 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922523975 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922525883 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922559977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922590017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922616005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922642946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922669888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922694921 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922712088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922722101 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922728062 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922749043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922756910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922758102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922765970 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922772884 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922779083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922782898 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922785997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922791958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922808886 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922811031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922837973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922852039 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922862053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922882080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922913074 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.922954082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.922987938 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923053980 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923067093 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923073053 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923156977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923187017 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923221111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923250914 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923252106 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923265934 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923279047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923305988 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923332930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923335075 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923345089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923352957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923360109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923477888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923501015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923569918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923614979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923644066 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923671007 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923697948 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923696995 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923710108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923726082 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923753023 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923758984 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923773050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923782110 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923793077 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.923810959 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923837900 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923865080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.923942089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924004078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924015045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924021006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924104929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924133062 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924220085 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924232006 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924283981 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924312115 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924339056 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924366951 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924400091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924401999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924411058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924416065 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924432039 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924459934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924488068 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924487114 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924501896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924511909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924515009 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924520969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924541950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924563885 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924570084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924573898 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924597979 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924632072 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924663067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924690008 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924700022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924710989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924717903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924717903 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924725056 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924731016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924746990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924774885 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924782991 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924801111 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924829006 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924863100 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924870014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924882889 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924891949 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924892902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924900055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924921036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924948931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924956083 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.924977064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.924984932 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.925003052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.925010920 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.925029993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.925115108 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.925127983 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.925134897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.958520889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.958551884 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.958628893 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.991986990 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992043018 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992082119 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992158890 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992223978 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992239952 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992244005 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992248058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992327929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992398977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992460012 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992496014 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992506981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992511034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992548943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992583036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992588043 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992595911 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992609978 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992639065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992676973 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992714882 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992738008 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992762089 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992770910 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992774963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992819071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992819071 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992827892 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992865086 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992906094 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992945910 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.992960930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992979050 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.992994070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993009090 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993036032 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993062019 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993073940 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993110895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993160963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993160963 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993170023 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993175030 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993200064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993220091 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993237019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993274927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993314028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993334055 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993340015 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993350029 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993361950 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993406057 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993444920 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993458033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993480921 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993484974 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993525028 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993542910 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993549109 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993561983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993592024 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993601084 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993653059 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993662119 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993670940 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993690968 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993737936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993782043 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993786097 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993792057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993794918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993820906 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993938923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.993946075 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993952990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.993978977 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994015932 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994018078 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994024992 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994064093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994106054 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994143963 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994157076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994167089 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994172096 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994183064 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994215965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994223118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994262934 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994302034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994333982 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994338989 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994339943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994343042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994362116 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994388103 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994424105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994431019 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994468927 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994507074 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994513988 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994520903 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994525909 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994544983 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994560957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994580984 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994620085 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994657993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994673967 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994680882 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994683981 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994705915 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994728088 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994749069 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994787931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994812965 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994820118 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994826078 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994843960 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994864941 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994895935 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994903088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994942904 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.994956017 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994962931 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.994981050 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995002985 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995027065 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995034933 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995069027 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995106936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995121956 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995131969 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995161057 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995177031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995218992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995254993 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995275974 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995285034 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995292902 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995330095 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995362997 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995366096 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995368958 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995404005 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995441914 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995455027 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995460033 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995462894 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995487928 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995528936 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995567083 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995579004 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995588064 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995593071 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995605946 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995615959 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995644093 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995681047 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995717049 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995728016 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995734930 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995738029 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995754004 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995768070 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995803118 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995841026 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995845079 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995882034 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995919943 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995920897 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995932102 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995938063 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.995958090 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.995994091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996032000 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996040106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996046066 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996051073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996068954 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996114969 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996118069 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996129036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996156931 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996193886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996206045 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996215105 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996265888 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996304035 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996306896 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996314049 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996341944 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996380091 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996391058 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996396065 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996426105 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996468067 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996505022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996505976 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996511936 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996516943 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996545076 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996582031 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996592999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996604919 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996618986 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996656895 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996694088 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996695042 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996716022 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996720076 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996756077 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996758938 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996798992 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996822119 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996835947 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996881962 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996923923 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.996937990 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996948957 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.996962070 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997001886 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997014999 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997023106 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997039080 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997051954 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997073889 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997090101 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997112036 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997129917 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997148037 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997165918 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997194052 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997200966 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997236013 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997245073 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997271061 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:31.997286081 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:31.997323036 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:32.004743099 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:50.395319939 CEST	49772	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:50.465415955 CEST	443	49772	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:50.465550900 CEST	49772	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:50.471357107 CEST	49772	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:50.541657925 CEST	443	49772	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:50.541680098 CEST	443	49772	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:50.541821003 CEST	49772	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:50.542433977 CEST	49772	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:50.558440924 CEST	49772	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:50:50.628626108 CEST	443	49772	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:50.633672953 CEST	443	49772	94.130.13.99	192.168.2.4
Jul 19, 2021 11:50:50.633788109 CEST	49772	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:12.570785999 CEST	49773	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:12.642550945 CEST	443	49773	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:12.642762899 CEST	49773	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:12.645385981 CEST	49773	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:12.714818954 CEST	443	49773	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:12.714955091 CEST	443	49773	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:12.715130091 CEST	49773	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:12.716572046 CEST	49773	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:12.736644030 CEST	49773	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:12.807427883 CEST	443	49773	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:12.812659025 CEST	443	49773	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:12.812953949 CEST	49773	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:26.775089025 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:51:26.775197983 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:51:26.775329113 CEST	49748	443	192.168.2.4	217.195.25.241
Jul 19, 2021 11:51:26.827478886 CEST	443	49748	217.195.25.241	192.168.2.4
Jul 19, 2021 11:51:26.985357046 CEST	80	49749	217.195.25.242	192.168.2.4
Jul 19, 2021 11:51:33.826086044 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:51:33.826111078 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:51:33.826261044 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:51:33.827408075 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:51:33.827497005 CEST	49751	443	192.168.2.4	176.9.52.221
Jul 19, 2021 11:51:33.900145054 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:51:33.900173903 CEST	443	49751	176.9.52.221	192.168.2.4
Jul 19, 2021 11:51:34.801439047 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:34.801464081 CEST	443	49752	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:34.801584959 CEST	49752	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:36.503423929 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:36.503463030 CEST	443	49753	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:36.503499031 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:36.503529072 CEST	49753	443	192.168.2.4	94.130.13.99
Jul 19, 2021 11:51:55.633989096 CEST	443	49772	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:55.634053946 CEST	443	49772	94.130.13.99	192.168.2.4
Jul 19, 2021 11:51:55.634505987 CEST	49772	443	192.168.2.4	94.130.13.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 19, 2021 11:49:41.201431990 CEST	53097	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:41.251332045 CEST	53	53097	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:42.758322001 CEST	49257	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:42.807677031 CEST	53	49257	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:43.709002972 CEST	62389	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:43.762101889 CEST	53	62389	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:44.817604065 CEST	49910	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:44.877866983 CEST	53	49910	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:45.903289080 CEST	55854	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:45.961613894 CEST	53	55854	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:47.108493090 CEST	64549	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:47.168596983 CEST	53	64549	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:48.073648930 CEST	63153	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:48.123990059 CEST	53	63153	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:50.096182108 CEST	52991	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:50.149226904 CEST	53	52991	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:50.568068981 CEST	53700	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:50.627844095 CEST	53	53700	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:50.972948074 CEST	51726	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:51.039232969 CEST	53	51726	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:51.059763908 CEST	56794	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:51.109827995 CEST	53	56794	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:53.719856024 CEST	56534	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:53.778107882 CEST	53	56534	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:54.762590885 CEST	56627	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:54.820077896 CEST	53	56627	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:55.596281052 CEST	56621	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:55.655077934 CEST	53	56621	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:57.695987940 CEST	63116	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:57.745096922 CEST	53	63116	8.8.8.8	192.168.2.4
Jul 19, 2021 11:49:59.895014048 CEST	64078	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:49:59.945194006 CEST	53	64078	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:00.765057087 CEST	64801	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:00.821922064 CEST	53	64801	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:01.577748060 CEST	61721	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:01.626914978 CEST	53	61721	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:03.179450035 CEST	51255	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:03.234213114 CEST	53	51255	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:06.266464949 CEST	61522	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:06.316114902 CEST	53	61522	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:07.934586048 CEST	53157	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:07.986953974 CEST	53	53157	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:10.994635105 CEST	52337	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:11.053563118 CEST	53	52337	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:13.672472954 CEST	55046	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:13.731852055 CEST	53	55046	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:26.328677893 CEST	49612	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:26.429241896 CEST	53	49612	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:26.785362005 CEST	49285	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:26.842485905 CEST	53	49285	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:26.993226051 CEST	50601	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:27.050621033 CEST	53	50601	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:28.267873049 CEST	60875	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:28.332552910 CEST	53	60875	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:29.442318916 CEST	56448	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:29.502228975 CEST	53	56448	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:34.841485977 CEST	59172	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:34.931266069 CEST	62420	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:34.942481995 CEST	53	59172	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:34.989964008 CEST	53	62420	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:35.631309032 CEST	60579	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:35.689311028 CEST	53	60579	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:36.405302048 CEST	50183	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:36.464363098 CEST	53	50183	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:37.193304062 CEST	61531	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:37.302383900 CEST	53	61531	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:37.975641966 CEST	49228	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:38.025121927 CEST	53	49228	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:38.466017008 CEST	59794	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:38.526177883 CEST	53	59794	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:38.705452919 CEST	55916	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:38.774166107 CEST	53	55916	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:39.237137079 CEST	52752	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:39.297749043 CEST	53	52752	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:42.695017099 CEST	60542	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:42.755650043 CEST	53	60542	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:43.977056026 CEST	60689	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:44.035085917 CEST	53	60689	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:45.390033960 CEST	64206	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:45.451019049 CEST	53	64206	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:45.507874966 CEST	50904	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:45.565397978 CEST	53	50904	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:46.027396917 CEST	57525	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:46.087805033 CEST	53	57525	8.8.8.8	192.168.2.4
Jul 19, 2021 11:50:49.802309036 CEST	53814	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:50:49.862106085 CEST	53	53814	8.8.8.8	192.168.2.4
Jul 19, 2021 11:51:20.849214077 CEST	53418	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:51:20.909281969 CEST	53	53418	8.8.8.8	192.168.2.4
Jul 19, 2021 11:51:22.616971970 CEST	62833	53	192.168.2.4	8.8.8.8
Jul 19, 2021 11:51:22.675673008 CEST	53	62833	8.8.8.8	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Jul 19, 2021 11:50:13.737195015 CEST	192.168.2.4	94.130.13.99	66fb	Echo
Jul 19, 2021 11:50:13.809725046 CEST	94.130.13.99	192.168.2.4	6efb	Echo Reply
Jul 19, 2021 11:50:45.566482067 CEST	192.168.2.4	94.130.13.99	6b8c	Echo
Jul 19, 2021 11:50:45.639193058 CEST	94.130.13.99	192.168.2.4	738c	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 19, 2021 11:49:50.568068981 CEST	192.168.2.4	8.8.8.8	0xf9a2	Standard query (0)	webtools.avanquest.com	A (IP address)	IN (0x0001)
Jul 19, 2021 11:49:50.972948074 CEST	192.168.2.4	8.8.8.8	0x8c75	Standard query (0)	cdn.pchelpsoft.com	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:13.672472954 CEST	192.168.2.4	8.8.8.8	0xeb1f	Standard query (0)	receiver.smartpcupdate.com	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:26.328677893 CEST	192.168.2.4	8.8.8.8	0x783d	Standard query (0)	webtools.avanquest.com	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:26.785362005 CEST	192.168.2.4	8.8.8.8	0xedc4	Standard query (0)	webtools.pchelpsoft.com	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:26.993226051 CEST	192.168.2.4	8.8.8.8	0xa484	Standard query (0)	www.pchelpsoft.com	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:28.267873049 CEST	192.168.2.4	8.8.8.8	0xb4af	Standard query (0)	techsupport.smartpcupdate.com	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:29.442318916 CEST	192.168.2.4	8.8.8.8	0x61e6	Standard query (0)	receiver.smartpcupdate.com	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:45.507874966 CEST	192.168.2.4	8.8.8.8	0x7d12	Standard query (0)	receiver.smartpcupdate.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 19, 2021 11:49:50.627844095 CEST	8.8.8.8	192.168.2.4	0xf9a2	No error (0)	webtools.avanquest.com		217.195.25.241	A (IP address)	IN (0x0001)
Jul 19, 2021 11:49:51.039232969 CEST	8.8.8.8	192.168.2.4	0x8c75	No error (0)	cdn.pchelpsoft.com	d2tfm4s145tlst.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jul 19, 2021 11:49:51.039232969 CEST	8.8.8.8	192.168.2.4	0x8c75	No error (0)	d2tfm4s145tlst.cloudfront.net		13.225.74.90	A (IP address)	IN (0x0001)
Jul 19, 2021 11:49:51.039232969 CEST	8.8.8.8	192.168.2.4	0x8c75	No error (0)	d2tfm4s145tlst.cloudfront.net		13.225.74.49	A (IP address)	IN (0x0001)
Jul 19, 2021 11:49:51.039232969 CEST	8.8.8.8	192.168.2.4	0x8c75	No error (0)	d2tfm4s145tlst.cloudfront.net		13.225.74.66	A (IP address)	IN (0x0001)
Jul 19, 2021 11:49:51.039232969 CEST	8.8.8.8	192.168.2.4	0x8c75	No error (0)	d2tfm4s145tlst.cloudfront.net		13.225.74.54	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:07.986953974 CEST	8.8.8.8	192.168.2.4	0x52b2	No error (0)	a-0019.a.dns.azurefd.net	a-0019.standard.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 19, 2021 11:50:13.731852055 CEST	8.8.8.8	192.168.2.4	0xeb1f	No error (0)	receiver.smartpcupdate.com		94.130.13.99	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:26.429241896 CEST	8.8.8.8	192.168.2.4	0x783d	No error (0)	webtools.avanquest.com		217.195.25.241	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:26.842485905 CEST	8.8.8.8	192.168.2.4	0xedc4	No error (0)	webtools.pchelpsoft.com		217.195.25.242	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:27.050621033 CEST	8.8.8.8	192.168.2.4	0xa484	No error (0)	www.pchelpsoft.com	pchelpsoft.com		CNAME (Canonical name)	IN (0x0001)
Jul 19, 2021 11:50:27.050621033 CEST	8.8.8.8	192.168.2.4	0xa484	No error (0)	pchelpsoft.com		34.202.46.34	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:28.332552910 CEST	8.8.8.8	192.168.2.4	0xb4af	No error (0)	techsupport.smartpcupdate.com		176.9.52.221	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:29.502228975 CEST	8.8.8.8	192.168.2.4	0x61e6	No error (0)	receiver.smartpcupdate.com		94.130.13.99	A (IP address)	IN (0x0001)
Jul 19, 2021 11:50:45.565397978 CEST	8.8.8.8	192.168.2.4	0x7d12	No error (0)	receiver.smartpcupdate.com		94.130.13.99	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

webtools.pchelpsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49749	217.195.25.242	80	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe

Timestamp	kBytes transferred	Direction	Data
Jul 19, 2021 11:50:26.899100065 CEST	8504	OUT	GET /install_success.cfm?redirectId=pchelpsoft/driver_updater_tracked.htm&target=https://www.pchelpsoft.com&dcid=216151425&purl=1&mkey1=DT_TRACK_ALL&tracking=DT_TRACK_ALL&mkey10=DT_TRACK_ALL HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (Windows; U) Connection: Keep-Alive Cache-Control: no-cache Host: webtools.pchelpsoft.com
Jul 19, 2021 11:50:26.985891104 CEST	8504	IN	HTTP/1.1 302 Found Cache-Control: no-cache Pragma: no-cache Content-Type: text/html;charset=UTF-8 Location: https://www.pchelpsoft.com?mkey1=DT_TRACK_ALL&dcid=216151425&purl=1&mkey10=DT_TRACK_ALL Date: Mon, 19 Jul 2021 09:50:26 GMT Content-Length: 89 Data Raw: 20 0d 0a 0d 0a 0d 0a 20 0d 0a 0d 0a 0d 0a 20 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 20 0d 0a 20 0d 0a 20 0d 0a 20 0d 0a 20 0d 0a 09 20 0d 0a 20 0d 0a 0d 0a 20 0d 0a 20 0d 0a 20 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 0d 0a 0d 0a 0d 0a Data Ascii:

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jul 19, 2021 11:49:50.756659031 CEST	217.195.25.241	443	192.168.2.4	49733	CN=*.avanquest.com, O=AVANQUEST SOFTWARE, OU=IT, L=La Garenne-Colombes, ST=le-de-France, C=FR CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE	CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Wed Mar 25 15:15:54 CET 2020 Wed Nov 21 01:00:00 CET 2018	Thu Jun 09 16:34:55 CEST 2022 Tue Nov 21 01:00:00 CET 2028	771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13,29-23-25-24,0-1-2	807fca46d9d0cf63adf4e5e80e414bbe
Jul 19, 2021 11:49:50.756659031 CEST	217.195.25.241	443	192.168.2.4	49733	CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Wed Nov 21 01:00:00 CET 2018	Tue Nov 21 01:00:00 CET 2028		807fca46d9d0cf63adf4e5e80e414bbe
Jul 19, 2021 11:49:51.141233921 CEST	13.225.74.90	443	192.168.2.4	49734	CN=cdn.pchelpsoft.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Mar 10 01:00:00 CET 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Apr 09 01:59:59 CEST 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13,29-23-25-24,0-1-2	807fca46d9d0cf63adf4e5e80e414bbe
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jul 19, 2021 11:50:26.569668055 CEST	217.195.25.241	443	192.168.2.4	49748	CN=*.avanquest.com, O=AVANQUEST SOFTWARE, OU=IT, L=La Garenne-Colombes, ST=le-de-France, C=FR CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE	CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Wed Mar 25 15:15:54 CET 2020 Wed Nov 21 01:00:00 CET 2018	Thu Jun 09 16:34:55 CEST 2022 Tue Nov 21 01:00:00 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Jul 19, 2021 11:50:26.569668055 CEST	217.195.25.241	443	192.168.2.4	49748	CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Wed Nov 21 01:00:00 CET 2018	Tue Nov 21 01:00:00 CET 2028		37f463bf4616ecd445d4a1937da06e19
Jul 19, 2021 11:50:27.379165888 CEST	34.202.46.34	443	192.168.2.4	49750	CN=www.pchelpsoft.com, O=PC Helpsoft Labs Inc, L=Victoria, ST=British Columbia, C=CA, SERIALNUMBER=BC0884553, OID.1.3.6.1.4.1.311.60.2.1.2=British Columbia, OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Apr 08 02:00:00 CEST 2021 Tue Oct 22 14:00:00 CEST 2013	Thu Apr 21 01:59:59 CEST 2022 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Jul 19, 2021 11:50:27.379165888 CEST	34.202.46.34	443	192.168.2.4	49750	CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		37f463bf4616ecd445d4a1937da06e19
Jul 19, 2021 11:50:28.559895992 CEST	176.9.52.221	443	192.168.2.4	49751	CN=techsupport.smartpcupdate.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon Dec 14 01:00:00 CET 2020 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Wed Dec 15 00:59:59 CET 2021 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Jul 19, 2021 11:50:29.646368980 CEST	94.130.13.99	443	192.168.2.4	49752	CN=receiver.smartpcupdate.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon Dec 14 01:00:00 CET 2020 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Wed Dec 15 00:59:59 CET 2021 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cmd.exe PID: 6872 Parent PID: 4940

General

Start time:	11:49:48
Start date:	19/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe' > cmdline.out 2>&1
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6916 Parent PID: 6872

General

Start time:	11:49:49
Start date:	19/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: wget.exe PID: 6988 Parent PID: 6872

General

Start time:	11:49:50
Start date:	19/07/2021
Path:	C:\Windows\SysWOW64\wget.exe
Wow64 process (32bit):	true
Commandline:	wget -t 2 -v -T 60 -P 'C:\Users\user\Desktop\download' --no-check-certificate --content-disposition --user-agent='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko' 'https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe'
Imagebase:	0x400000
File size:	3895184 bytes
MD5 hash:	3DADB6E2ECE9C4B3E1E322E617658B60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: Driver_Updater.exe PID: 1088 Parent PID: 5820

General

Start time:	11:49:58
Start date:	19/07/2021
Path:	C:\Users\user\Desktop\download\Driver_Updater.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\download\Driver_Updater.exe'
Imagebase:	0x400000
File size:	6052448 bytes
MD5 hash:	E0B9B386B29E117110318302CE973889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Chronological Activities

Analysis Process: Driver_Updater.tmp PID: 6364 Parent PID: 1088

General

Start time:	11:49:59
Start date:	19/07/2021
Path:	C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\is-PJFOO.tmp\Driver_Updater.tmp' /SL5='$3802C0,5249794,721408,C:\Users\user\Desktop\download\Driver_Updater.exe'
Imagebase:	0x400000
File size:	2535424 bytes
MD5 hash:	84DB4B4205F705DA71471DC6ECC061F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000005.00000003.711277518.00000000053C3000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: PCHelpSoftDriverUpdater.exe PID: 6488 Parent PID: 6364

General

Start time:	11:50:09
Start date:	19/07/2021
Path:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe' /INSTALL
Imagebase:	0x400000
File size:	7873880 bytes
MD5 hash:	BDB2972360FC3DC01C7A39BDEE2B4DED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000006.00000000.689723843.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: PCHelpSoftDriverUpdater.exe PID: 6664 Parent PID: 6364

General

Start time:	11:50:18
Start date:	19/07/2021
Path:	C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\PC HelpSoft Driver Updater\PCHelpSoftDriverUpdater.exe' /START
Imagebase:	0x400000
File size:	7873880 bytes
MD5 hash:	BDB2972360FC3DC01C7A39BDEE2B4DED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000000.709347747.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6624 Parent PID: 6664

General

Start time:	11:50:21
Start date:	19/07/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Schedule' /F
Imagebase:	0xbb0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6996 Parent PID: 6624

General

Start time:	11:50:22
Start date:	19/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 7020 Parent PID: 6664

General

Start time:	11:50:22
Start date:	19/07/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Delete /TN 'PC HelpSoft Driver Updater Monitoring' /F
Imagebase:	0xbb0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 7100 Parent PID: 7020

General

Start time:	11:50:24
Start date:	19/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: HDMTray.exe PID: 7164 Parent PID: 968

General

Start time:	11:50:25
Start date:	19/07/2021
Path:	C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe
Imagebase:	0x400000
File size:	3533656 bytes
MD5 hash:	CA2A9C91909A669420DDB908B32A5E52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000F.00000000.725252382.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000F.00000002.728141654.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: HDMTray.exe PID: 6272 Parent PID: 6664

General

Start time:	11:50:25
Start date:	19/07/2021
Path:	C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\PC HelpSoft Driver Updater\HDMTray.exe'
Imagebase:	0x400000
File size:	3533656 bytes
MD5 hash:	CA2A9C91909A669420DDB908B32A5E52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000010.00000000.725405866.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000010.00000002.930022159.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Driver_Updater.exe PID: 1088 Parent PID: 5820 Driver_Updater.exeCOMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12%
Total number of Nodes:	836
Total number of Limit Nodes:	33

Executed Functions

Function 004A7114, Relevance: 43.9, APIs: 7, Strings: 18, Instructions: 165
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E004A7114(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				long _t39;
				_Unknown_base(*)()* _t42;
				_Unknown_base(*)()* _t43;
				_Unknown_base(*)()* _t46;
				signed int _t51;
				void* _t111;
				void* _t112;
				intOrPtr _t129;
				struct HINSTANCE__* _t148;
				intOrPtr* _t150;
				intOrPtr _t152;
				intOrPtr _t153;

				_t152 = _t153;
				_t112 = 7;
				do {
					_push(0);
					_push(0);
					_t112 = _t112 - 1;
				} while (_t112 != 0);
				_push(_t152);
				_push(0x4a7388);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				 *0x4b0664 =  *0x4b0664 - 1;
				if( *0x4b0664 >= 0) {
					L19:
					_pop(_t129);
					 *[fs:eax] = _t129;
					_push(0x4a738f);
					return E00407A54( &_v60, 0xe);
				} else {
					_t148 = GetModuleHandleW(L"kernel32.dll");
					_t39 = GetVersion();
					_t111 = 0;
					if(_t39 != 0x600) {
						_t150 = GetProcAddress(_t148, "SetDefaultDllDirectories");
						if(_t150 != 0) {
							 *_t150(0x800);
							asm("sbb ebx, ebx");
							_t111 = 1;
						}
					}
					if(_t111 == 0) {
						_t46 = GetProcAddress(_t148, "SetDllDirectoryW");
						if(_t46 != 0) {
							 *_t46(0x4a73e4);
						}
						E0040E818( &_v8);
						E00407DD4(0x4b0668, _v8);
						if( *0x4b0668 != 0) {
							_t51 =  *0x4b0668;
							if(_t51 != 0) {
								_t51 =  *(_t51 - 4);
							}
							if( *((short*)( *0x4b0668 + _t51 * 2 - 2)) != 0x5c) {
								E004086C4(0x4b0668, 0x4a73f4);
							}
							E0040871C( &_v12, L"uxtheme.dll",  *0x4b0668);
							E0040E844(_v12, _t111);
							E0040871C( &_v16, L"userenv.dll",  *0x4b0668);
							E0040E844(_v16, _t111);
							E0040871C( &_v20, L"setupapi.dll",  *0x4b0668);
							E0040E844(_v20, _t111);
							E0040871C( &_v24, L"apphelp.dll",  *0x4b0668);
							E0040E844(_v24, _t111);
							E0040871C( &_v28, L"propsys.dll",  *0x4b0668);
							E0040E844(_v28, _t111);
							E0040871C( &_v32, L"dwmapi.dll",  *0x4b0668);
							E0040E844(_v32, _t111);
							E0040871C( &_v36, L"cryptbase.dll",  *0x4b0668);
							E0040E844(_v36, _t111);
							E0040871C( &_v40, L"oleacc.dll",  *0x4b0668);
							E0040E844(_v40, _t111);
							E0040871C( &_v44, L"version.dll",  *0x4b0668);
							E0040E844(_v44, _t111);
							E0040871C( &_v48, L"profapi.dll",  *0x4b0668);
							E0040E844(_v48, _t111);
							E0040871C( &_v52, L"comres.dll",  *0x4b0668);
							E0040E844(_v52, _t111);
							E0040871C( &_v56, L"clbcatq.dll",  *0x4b0668);
							E0040E844(_v56, _t111);
							E0040871C( &_v60, L"ntmarta.dll",  *0x4b0668);
							E0040E844(_v60, _t111);
						}
					}
					_t42 = GetProcAddress(_t148, "SetSearchPathMode");
					if(_t42 != 0) {
						 *_t42(0x8001);
					}
					_t43 = GetProcAddress(_t148, "SetProcessDEPPolicy");
					if(_t43 != 0) {
						 *_t43(1); // executed
					}
					goto L19;
				}
			}

0x004a7115
0x004a7117
0x004a711c
0x004a711c
0x004a711e
0x004a7120
0x004a7120
0x004a7128
0x004a7129
0x004a712e
0x004a7131
0x004a7134
0x004a713b
0x004a736d
0x004a736f
0x004a7372
0x004a7375
0x004a7387
0x004a7141
0x004a714b
0x004a714d
0x004a7154
0x004a715a
0x004a7167
0x004a716b
0x004a7172
0x004a7177
0x004a7179
0x004a7179
0x004a716b
0x004a717c
0x004a7188
0x004a718f
0x004a7196
0x004a7196
0x004a719b
0x004a71a8
0x004a71b4
0x004a71ba
0x004a71c1
0x004a71c6
0x004a71c6
0x004a71d4
0x004a71e0
0x004a71e0
0x004a71f3
0x004a71fb
0x004a720e
0x004a7216
0x004a7229
0x004a7231
0x004a7244
0x004a724c
0x004a725f
0x004a7267
0x004a727a
0x004a7282
0x004a7295
0x004a729d
0x004a72b0
0x004a72b8
0x004a72cb
0x004a72d3
0x004a72e6
0x004a72ee
0x004a7301
0x004a7309
0x004a731c
0x004a7324
0x004a7337
0x004a733f
0x004a733f
0x004a71b4
0x004a734a
0x004a7351
0x004a7358
0x004a7358
0x004a7360
0x004a7367
0x004a736b
0x004a736b
0x00000000
0x004a7367

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,004A7388,?,?,?,?,00000000,00000000), ref: 004A7146
GetVersion.KERNEL32(kernel32.dll,00000000,004A7388,?,?,?,?,00000000,00000000), ref: 004A714D
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004A7162
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004A7188

Part of subcall function 0040E844: SetErrorMode.KERNEL32(00008000), ref: 0040E852
Part of subcall function 0040E844: LoadLibraryW.KERNEL32(00000000,00000000,0040E89C,?,00000000,0040E8BA,?,00008000), ref: 0040E881

GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004A734A
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004A7360
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,00000000,004A7388,?,?,?,?,00000000,00000000), ref: 004A736B

Strings

version.dll, xrefs: 004A72C0
SetProcessDEPPolicy, xrefs: 004A735A
apphelp.dll, xrefs: 004A7239
cryptbase.dll, xrefs: 004A728A
SetDefaultDllDirectories, xrefs: 004A715C
propsys.dll, xrefs: 004A7254
userenv.dll, xrefs: 004A7203
SetSearchPathMode, xrefs: 004A7344
clbcatq.dll, xrefs: 004A7311
SetDllDirectoryW, xrefs: 004A7182
dwmapi.dll, xrefs: 004A726F
profapi.dll, xrefs: 004A72DB
uxtheme.dll, xrefs: 004A71E8
kernel32.dll, xrefs: 004A7141
oleacc.dll, xrefs: 004A72A5
comres.dll, xrefs: 004A72F6
setupapi.dll, xrefs: 004A721E
ntmarta.dll, xrefs: 004A732C

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressProc$ErrorHandleLibraryLoadModeModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$ntmarta.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 2248137261-1119018034
Opcode ID: 3cff10d8a37e8f74ee08042b476ec0aeb1e7e16601af9275c0598c71473bbef6
Instruction ID: 02322ebf13ac6853ed14ef268a063699a4793311109b24e8029bbe3fde3c2d54
Opcode Fuzzy Hash: 3cff10d8a37e8f74ee08042b476ec0aeb1e7e16601af9275c0598c71473bbef6
Instruction Fuzzy Hash: 8E516E346441449BDB10FBA6CC82E9E73B5EBD6308B24863BE810772A5DB3CAD55CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 004A162C, Relevance: 7.6, APIs: 5, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004A162C(void* __eax) {
				char _v44;
				struct _SYSTEM_INFO _v80;
				long _v84;
				char _v88;
				long _t22;
				int _t28;
				void* _t37;
				struct _MEMORY_BASIC_INFORMATION* _t40;
				long _t41;
				void** _t42;

				_t42 =  &(_v80.dwPageSize);
				 *_t42 = __eax;
				_t40 =  &_v44;
				GetSystemInfo( &_v80); // executed
				_t22 = VirtualQuery( *_t42, _t40, 0x1c);
				if(_t22 == 0) {
					L17:
					return _t22;
				} else {
					while(1) {
						_t22 = _t40->AllocationBase;
						if(_t22 !=  *_t42) {
							goto L17;
						}
						if(_t40->State != 0x1000 || (_t40->Protect & 0x00000001) != 0) {
							L15:
							_t22 = VirtualQuery(_t40->BaseAddress + _t40->RegionSize, _t40, 0x1c);
							if(_t22 == 0) {
								goto L17;
							}
							continue;
						} else {
							_v88 = 0;
							_t41 = _t40->Protect;
							if(_t41 == 1 || _t41 == 2 || _t41 == 0x10 || _t41 == 0x20) {
								_t28 = VirtualProtect(_t40->BaseAddress, _t40->RegionSize, 0x40,  &_v84); // executed
								if(_t28 != 0) {
									_v88 = 1;
								}
							}
							_t37 = 0;
							while(_t37 < _t40->RegionSize) {
								E004A1624(_t40->BaseAddress + _t37);
								_t37 = _t37 + _v80.dwPageSize;
							}
							if(_v88 != 0) {
								VirtualProtect( *_t40, _t40->RegionSize, _v84,  &_v84); // executed
							}
							goto L15;
						}
					}
					goto L17;
				}
			}

0x004a1630
0x004a1633
0x004a1636
0x004a163f
0x004a164b
0x004a1652
0x004a16fe
0x004a16fe
0x004a1658
0x004a16eb
0x004a16eb
0x004a16f1
0x00000000
0x00000000
0x004a1664
0x004a16d7
0x004a16e2
0x004a16e9
0x00000000
0x00000000
0x00000000
0x004a166c
0x004a166c
0x004a1671
0x004a1677
0x004a1696
0x004a169d
0x004a169f
0x004a169f
0x004a169d
0x004a16a4
0x004a16b5
0x004a16ac
0x004a16b1
0x004a16b1
0x004a16bf
0x004a16d2
0x004a16d2
0x00000000
0x004a16bf
0x004a1664
0x00000000
0x004a16eb

APIs

GetSystemInfo.KERNEL32(?), ref: 004A163F
VirtualQuery.KERNEL32(?,?,0000001C,?), ref: 004A164B
VirtualProtect.KERNEL32(?,?,00000040,0000001C,?,?,0000001C), ref: 004A1696
VirtualProtect.KERNEL32(?,?,?,0000001C,?,?,00000040,0000001C,?,?,0000001C), ref: 004A16D2
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C,?), ref: 004A16E2

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 5b3962b5c6332dcebc7121228b8a4b3e3461861da3638e45f5f22f4c152fd88c
Instruction ID: 121c490457b7ae1f12085ab2edba84d2aabbc21e4026ddd200c69c56977e63ec
Opcode Fuzzy Hash: 5b3962b5c6332dcebc7121228b8a4b3e3461861da3638e45f5f22f4c152fd88c
Instruction Fuzzy Hash: D5216971504344ABD720EA59CD84EABB7E8AF66314F4C4C1EF694C32A1D33AE844CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3B8, Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040B3B8(char __eax, void* __ebx, intOrPtr* __edx, void* __eflags) {
				char _v8;
				short _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t29;
				void* _t40;
				intOrPtr* _t44;
				intOrPtr _t55;
				void* _t61;

				_push(__ebx);
				_v24 = 0;
				_v20 = 0;
				_t44 = __edx;
				_v8 = __eax;
				E00407AD8(_v8);
				_push(_t61);
				_push(0x40b478);
				_push( *[fs:eax]);
				 *[fs:eax] = _t61 + 0xffffffec;
				_t21 =  &_v16;
				L00403730();
				GetLocaleInfoW( &_v16 & 0x0000ffff, 3, _t21, 4);
				E0040856C( &_v20, 4,  &_v16);
				E0040871C(_t44, _v20, _v8);
				_t29 = E0040B268( *_t44, _t44); // executed
				if(_t29 == 0) {
					_v12 = 0;
					E0040856C( &_v24, 4,  &_v16);
					E0040871C(_t44, _v24, _v8);
					_t40 = E0040B268( *_t44, _t44); // executed
					if(_t40 == 0) {
						E004079F4(_t44);
					}
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E0040B47F);
				E00407A54( &_v24, 2);
				return E004079F4( &_v8);
			}

0x0040b3be
0x0040b3c1
0x0040b3c4
0x0040b3c7
0x0040b3c9
0x0040b3cf
0x0040b3d6
0x0040b3d7
0x0040b3dc
0x0040b3df
0x0040b3e4
0x0040b3ea
0x0040b3f3
0x0040b403
0x0040b410
0x0040b417
0x0040b41e
0x0040b420
0x0040b431
0x0040b43e
0x0040b445
0x0040b44c
0x0040b450
0x0040b450
0x0040b44c
0x0040b457
0x0040b45a
0x0040b45d
0x0040b46a
0x0040b477

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040B478,?,?), ref: 0040B3EA
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040B478,?,?), ref: 0040B3F3

Part of subcall function 0040B268: FindFirstFileW.KERNEL32(00000000,?,00000000,0040B2C6,?,?), ref: 0040B29B
Part of subcall function 0040B268: FindClose.KERNEL32(00000000,00000000,?,00000000,0040B2C6,?,?), ref: 0040B2AB

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 7c11227e8b53d5cf57ab3c00df66d88cc61cce9a5cb76bffb90c21d47624e2da
Instruction ID: 9155c5fd2a6d7a32e17c8bb0479b116e8c2ecdb55d1a06f7ce78c4880fdbda1e
Opcode Fuzzy Hash: 7c11227e8b53d5cf57ab3c00df66d88cc61cce9a5cb76bffb90c21d47624e2da
Instruction Fuzzy Hash: B9117570A041499BDB00EFA5C942AAEB3B8EF44304F50407FB544B72D2DB385F04CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B268, Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040B268(char __eax, signed int __ebx) {
				char _v8;
				struct _WIN32_FIND_DATAW _v600;
				void* _t15;
				intOrPtr _t24;
				void* _t27;

				_push(__ebx);
				_v8 = __eax;
				E00407AD8(_v8);
				_push(_t27);
				_push(0x40b2c6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27 + 0xfffffdac;
				_t15 = FindFirstFileW(E004084C8(_v8),  &_v600); // executed
				if((__ebx & 0xffffff00 | _t15 != 0xffffffff) != 0) {
					FindClose(_t15);
				}
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E0040B2CD);
				return E004079F4( &_v8);
			}

0x0040b271
0x0040b272
0x0040b278
0x0040b27f
0x0040b280
0x0040b285
0x0040b288
0x0040b29b
0x0040b2a8
0x0040b2ab
0x0040b2ab
0x0040b2b2
0x0040b2b5
0x0040b2b8
0x0040b2c5

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040B2C6,?,?), ref: 0040B29B
FindClose.KERNEL32(00000000,00000000,?,00000000,0040B2C6,?,?), ref: 0040B2AB

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: dcd63df1445c4785f46ad18630efca613813575deacfdb2e7f3fde81f5b7913b
Instruction ID: af97b761f8286923e3e8c7c54c75c770fa091db835a787e0331ac1096eca1aa4
Opcode Fuzzy Hash: dcd63df1445c4785f46ad18630efca613813575deacfdb2e7f3fde81f5b7913b
Instruction Fuzzy Hash: 56F0BE70914248AECB21EB75CC5295EB7ACEB44310BA005BAB804F32D1EB38AF009A5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE8C, Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E0040AE8C(char __eax, void* __ebx, void* __ecx, void* __edx) {
				char _v8;
				char* _v12;
				void* _v16;
				int _v20;
				short _v542;
				long _t51;
				long _t85;
				long _t87;
				long _t89;
				long _t91;
				long _t93;
				void* _t97;
				intOrPtr _t106;
				intOrPtr _t108;
				void* _t112;
				void* _t113;
				intOrPtr _t114;

				_t112 = _t113;
				_t114 = _t113 + 0xfffffde4;
				_t97 = __edx;
				_v8 = __eax;
				E00407AD8(_v8);
				_push(_t112);
				_push(0x40b0b1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t114;
				if(_v8 != 0) {
					E0040A6C0( &_v542, E004084C8(_v8), 0x105);
				} else {
					GetModuleFileNameW(0,  &_v542, 0x105);
				}
				if(_v542 == 0) {
					L18:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(E0040B0B8);
					return E004079F4( &_v8);
				} else {
					_v12 = 0;
					_t51 = RegOpenKeyExW(0x80000001, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
					if(_t51 == 0) {
						L10:
						_push(_t112);
						_push(0x40b094);
						_push( *[fs:eax]);
						 *[fs:eax] = _t114;
						E0040AC9C( &_v542, 0x105);
						if(RegQueryValueExW(_v16,  &_v542, 0, 0, 0,  &_v20) != 0) {
							if(RegQueryValueExW(_v16, E0040B1A4, 0, 0, 0,  &_v20) == 0) {
								_v12 = E004053F0(_v20);
								RegQueryValueExW(_v16, E0040B1A4, 0, 0, _v12,  &_v20);
								E00408530(_t97, _v12);
							}
						} else {
							_v12 = E004053F0(_v20);
							RegQueryValueExW(_v16,  &_v542, 0, 0, _v12,  &_v20);
							E00408530(_t97, _v12);
						}
						_pop(_t108);
						 *[fs:eax] = _t108;
						_push(E0040B09B);
						if(_v12 != 0) {
							E0040540C(_v12);
						}
						return RegCloseKey(_v16);
					} else {
						_t85 = RegOpenKeyExW(0x80000002, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
						if(_t85 == 0) {
							goto L10;
						} else {
							_t87 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
							if(_t87 == 0) {
								goto L10;
							} else {
								_t89 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
								if(_t89 == 0) {
									goto L10;
								} else {
									_t91 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v16); // executed
									if(_t91 == 0) {
										goto L10;
									} else {
										_t93 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v16); // executed
										if(_t93 != 0) {
											goto L18;
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				}
			}

0x0040ae8d
0x0040ae8f
0x0040ae96
0x0040ae98
0x0040ae9e
0x0040aea5
0x0040aea6
0x0040aeab
0x0040aeae
0x0040aeb5
0x0040aee1
0x0040aeb7
0x0040aec5
0x0040aec5
0x0040aeee
0x0040b09b
0x0040b09d
0x0040b0a0
0x0040b0a3
0x0040b0b0
0x0040aef4
0x0040aef6
0x0040af0e
0x0040af15
0x0040afb5
0x0040afb7
0x0040afb8
0x0040afbd
0x0040afc0
0x0040afce
0x0040afef
0x0040b03e
0x0040b048
0x0040b060
0x0040b06a
0x0040b06a
0x0040aff1
0x0040aff9
0x0040b013
0x0040b01d
0x0040b01d
0x0040b071
0x0040b074
0x0040b077
0x0040b080
0x0040b085
0x0040b085
0x0040b093
0x0040af1b
0x0040af30
0x0040af37
0x00000000
0x0040af39
0x0040af4e
0x0040af55
0x00000000
0x0040af57
0x0040af6c
0x0040af73
0x00000000
0x0040af75
0x0040af8a
0x0040af91
0x00000000
0x0040af93
0x0040afa8
0x0040afaf
0x00000000
0x00000000
0x00000000
0x00000000
0x0040afaf
0x0040af91
0x0040af73
0x0040af55
0x0040af37
0x0040af15

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040B0B1,?,?), ref: 0040AEC5
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040B0B1,?,?), ref: 0040AF0E
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040B0B1,?,?), ref: 0040AF30
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040AF4E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040AF6C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040AF8A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040AFA8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040B094,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040B0B1), ref: 0040AFE8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040B094,?,80000001), ref: 0040B013
RegCloseKey.ADVAPI32(?,0040B09B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040B094,?,80000001,Software\Embarcadero\Locales), ref: 0040B08E

Strings

Software\Borland\Locales, xrefs: 0040AF80
Software\Embarcadero\Locales, xrefs: 0040AF04, 0040AF26
Software\Borland\Delphi\Locales, xrefs: 0040AF9E
Software\CodeGear\Locales, xrefs: 0040AF44, 0040AF62

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: a7a4f7800a908a23690c429c9108a661baea305ffcb50fe6ed6af284978fef88
Instruction ID: 511bc42bdc18c233ca4c8d7f1893363b3cc50658f2258b81fe6dc99cbd1a726a
Opcode Fuzzy Hash: a7a4f7800a908a23690c429c9108a661baea305ffcb50fe6ed6af284978fef88
Instruction Fuzzy Hash: CE5121B5A50208BEEB10DAA5CC46FAFB7ACDB08704F504077BA14F61C1E7B8AA44865D

Uniqueness

Uniqueness Score: -1.00%

Function 0040426C, Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0040426C(void* __eax, signed int __edi, void* __ebp) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				signed int __ebx;
				void* _t58;
				signed int _t61;
				int _t65;
				signed int _t67;
				void _t70;
				int _t71;
				signed int _t78;
				void* _t79;
				signed int _t81;
				intOrPtr _t82;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed int _t92;
				void* _t96;
				signed int _t99;
				void* _t103;
				intOrPtr _t104;
				void* _t106;
				void* _t108;
				signed int _t113;
				void* _t115;
				void* _t116;

				_t56 = __eax;
				_t89 =  *(__eax - 4);
				_t78 =  *0x4ad059; // 0x0
				if((_t89 & 0x00000007) != 0) {
					__eflags = _t89 & 0x00000005;
					if((_t89 & 0x00000005) != 0) {
						_pop(_t78);
						__eflags = _t89 & 0x00000003;
						if((_t89 & 0x00000003) == 0) {
							_push(_t78);
							_push(__edi);
							_t116 = _t115 + 0xffffffdc;
							_t103 = __eax - 0x10;
							E00403C48();
							_t58 = _t103;
							 *_t116 =  *_t58;
							_v48 =  *((intOrPtr*)(_t58 + 4));
							_t92 =  *(_t58 + 0xc);
							if((_t92 & 0x00000008) != 0) {
								_t79 = _t103;
								_t113 = _t92 & 0xfffffff0;
								_t99 = 0;
								__eflags = 0;
								while(1) {
									VirtualQuery(_t79,  &_v44, 0x1c);
									_t61 = VirtualFree(_t79, 0, 0x8000);
									__eflags = _t61;
									if(_t61 == 0) {
										_t99 = _t99 | 0xffffffff;
										goto L10;
									}
									_t104 = _v44.RegionSize;
									__eflags = _t113 - _t104;
									if(_t113 > _t104) {
										_t113 = _t113 - _t104;
										_t79 = _t79 + _t104;
										continue;
									}
									goto L10;
								}
							} else {
								_t65 = VirtualFree(_t103, 0, 0x8000); // executed
								if(_t65 == 0) {
									_t99 = __edi | 0xffffffff;
								} else {
									_t99 = 0;
								}
							}
							L10:
							if(_t99 == 0) {
								 *_v48 =  *_t116;
								 *( *_t116 + 4) = _v48;
							}
							 *0x4afb78 = 0;
							return _t99;
						} else {
							return 0xffffffff;
						}
					} else {
						goto L31;
					}
				} else {
					__eflags = __bl;
					__ebx =  *__edx;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L14;
							}
							asm("pause");
							__eflags =  *0x4ad989;
							if(__eflags != 0) {
								continue;
							} else {
								Sleep(0);
								__edx = __edx;
								__ecx = __ecx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__eflags != 0) {
									Sleep(0xa);
									__edx = __edx;
									__ecx = __ecx;
									continue;
								}
							}
							goto L14;
						}
					}
					L14:
					_t14 = __edx + 0x14;
					 *_t14 =  *(__edx + 0x14) - 1;
					__eflags =  *_t14;
					__eax =  *(__edx + 0x10);
					if( *_t14 == 0) {
						__eflags = __eax;
						if(__eax == 0) {
							L20:
							 *(__ebx + 0x14) = __eax;
						} else {
							__eax =  *(__edx + 0xc);
							__ecx =  *(__edx + 8);
							 *(__eax + 8) = __ecx;
							 *(__ecx + 0xc) = __eax;
							__eax = 0;
							__eflags =  *((intOrPtr*)(__ebx + 0x18)) - __edx;
							if( *((intOrPtr*)(__ebx + 0x18)) == __edx) {
								goto L20;
							}
						}
						 *__ebx = __al;
						__eax = __edx;
						__edx =  *(__edx - 4);
						__bl =  *0x4ad059; // 0x0
						L31:
						__eflags = _t78;
						_t81 = _t89 & 0xfffffff0;
						_push(_t101);
						_t106 = _t56;
						if(__eflags != 0) {
							while(1) {
								_t67 = 0x100;
								asm("lock cmpxchg [0x4adae8], ah");
								if(__eflags == 0) {
									goto L32;
								}
								asm("pause");
								__eflags =  *0x4ad989;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									_t67 = 0x100;
									asm("lock cmpxchg [0x4adae8], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L32;
							}
						}
						L32:
						__eflags = (_t106 - 4)[_t81] & 0x00000001;
						_t87 = (_t106 - 4)[_t81];
						if(((_t106 - 4)[_t81] & 0x00000001) != 0) {
							_t67 = _t81 + _t106;
							_t88 = _t87 & 0xfffffff0;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00403AC0(_t67);
							}
						} else {
							_t88 = _t87 | 0x00000008;
							__eflags = _t88;
							(_t106 - 4)[_t81] = _t88;
						}
						__eflags =  *(_t106 - 4) & 0x00000008;
						if(( *(_t106 - 4) & 0x00000008) != 0) {
							_t88 =  *(_t106 - 8);
							_t106 = _t106 - _t88;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00403AC0(_t106);
							}
						}
						__eflags = _t81 - 0x13ffe0;
						if(_t81 == 0x13ffe0) {
							__eflags =  *0x4adaf0 - 0x13ffe0;
							if( *0x4adaf0 != 0x13ffe0) {
								_t82 = _t106 + 0x13ffe0;
								E00403B60(_t67);
								 *((intOrPtr*)(_t82 - 4)) = 2;
								 *0x4adaf0 = 0x13ffe0;
								 *0x4adaec = _t82;
								 *0x4adae8 = 0;
								__eflags = 0;
								return 0;
							} else {
								_t108 = _t106 - 0x10;
								_t70 =  *_t108;
								_t96 =  *(_t108 + 4);
								 *(_t70 + 4) = _t96;
								 *_t96 = _t70;
								 *0x4adae8 = 0;
								_t71 = VirtualFree(_t108, 0, 0x8000);
								__eflags = _t71 - 1;
								asm("sbb eax, eax");
								return _t71;
							}
						} else {
							 *(_t106 - 4) = _t81 + 3;
							 *(_t106 - 8 + _t81) = _t81;
							E00403B00(_t106, _t88, _t81);
							 *0x4adae8 = 0;
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = __eax;
						 *(__edx + 0x10) = __ecx;
						 *(__ecx - 4) = __eax;
						if(__eflags == 0) {
							__ecx =  *(__ebx + 8);
							 *(__edx + 0xc) = __ebx;
							 *(__edx + 8) = __ecx;
							 *(__ecx + 0xc) = __edx;
							 *(__ebx + 8) = __edx;
							 *__ebx = 0;
							__eax = 0;
							__eflags = 0;
							_pop(__ebx);
							return 0;
						} else {
							__eax = 0;
							__eflags = 0;
							 *__ebx = __al;
							_pop(__ebx);
							return 0;
						}
					}
				}
			}

0x0040426c
0x0040426c
0x00404275
0x0040427b
0x00404364
0x00404367
0x00404454
0x00404455
0x00404458
0x00403cf8
0x00403cfa
0x00403cfc
0x00403d01
0x00403d04
0x00403d09
0x00403d0d
0x00403d13
0x00403d17
0x00403d1d
0x00403d39
0x00403d3d
0x00403d40
0x00403d40
0x00403d42
0x00403d4a
0x00403d57
0x00403d5c
0x00403d5e
0x00403d60
0x00403d63
0x00403d63
0x00403d65
0x00403d69
0x00403d6b
0x00403d6d
0x00403d6f
0x00000000
0x00403d6f
0x00000000
0x00403d6b
0x00403d1f
0x00403d27
0x00403d2e
0x00403d34
0x00403d30
0x00403d30
0x00403d30
0x00403d2e
0x00403d73
0x00403d75
0x00403d7e
0x00403d87
0x00403d87
0x00403d8a
0x00403d9a
0x0040445e
0x00404463
0x00404463
0x00000000
0x00000000
0x00000000
0x00404281
0x00404281
0x00404283
0x00404285
0x004042e8
0x004042e8
0x004042ed
0x004042f1
0x00000000
0x00000000
0x004042f3
0x004042f5
0x004042fc
0x00000000
0x004042fe
0x00404302
0x00404307
0x00404308
0x00404309
0x0040430e
0x00404312
0x0040431c
0x00404321
0x00404322
0x00000000
0x00404322
0x00404312
0x00000000
0x004042fc
0x004042e8
0x00404287
0x00404287
0x00404287
0x00404287
0x0040428b
0x0040428e
0x004042bc
0x004042be
0x004042d3
0x004042d3
0x004042c0
0x004042c0
0x004042c3
0x004042c6
0x004042c9
0x004042cc
0x004042ce
0x004042d1
0x00000000
0x00000000
0x004042d1
0x004042d6
0x004042d8
0x004042da
0x004042dd
0x0040436d
0x00404370
0x00404372
0x00404374
0x00404375
0x00404377
0x00404328
0x00404328
0x0040432d
0x00404335
0x00000000
0x00000000
0x00404337
0x00404339
0x00404340
0x00000000
0x00404342
0x00404344
0x00404349
0x0040434e
0x00404356
0x0040435a
0x00000000
0x0040435a
0x00404356
0x00000000
0x00404340
0x00404328
0x00404379
0x00404379
0x00404381
0x00404385
0x004043bc
0x004043bf
0x004043c2
0x004043c4
0x004043ca
0x004043cc
0x004043cc
0x00404387
0x00404387
0x00404387
0x0040438a
0x0040438a
0x0040438e
0x00404392
0x004043d4
0x004043d7
0x004043d9
0x004043db
0x004043e1
0x004043e5
0x004043e5
0x004043e1
0x00404394
0x0040439a
0x004043ec
0x004043f6
0x00404424
0x0040442a
0x0040442f
0x00404436
0x00404440
0x00404446
0x0040444d
0x00404451
0x004043f8
0x004043f8
0x004043fb
0x004043fd
0x00404400
0x00404403
0x00404405
0x00404414
0x00404419
0x0040441c
0x00404420
0x00404420
0x0040439c
0x0040439f
0x004043a2
0x004043aa
0x004043af
0x004043b6
0x004043ba
0x004043ba
0x00404290
0x00404290
0x00404292
0x00404298
0x0040429b
0x004042a4
0x004042a7
0x004042aa
0x004042ad
0x004042b0
0x004042b3
0x004042b6
0x004042b6
0x004042b8
0x004042b9
0x0040429d
0x0040429d
0x0040429d
0x0040429f
0x004042a1
0x004042a2
0x004042a2
0x0040429b
0x0040428e

APIs

Sleep.KERNEL32(00000000,?,?,00000000,0040BEB4,0040BF1A,?,00000000,?,?,0040C23D,00000000,?,00000000,0040C73E,00000000), ref: 00404302
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,0040BEB4,0040BF1A,?,00000000,?,?,0040C23D,00000000,?,00000000,0040C73E), ref: 0040431C

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6990eeb09af798ff89c122cab0389b867fa95b1857629a1b42165b3db1f08a53
Instruction ID: 42852a627608553f2d1d5efabc9574773b40d1f12e789e067a733302d184c96b
Opcode Fuzzy Hash: 6990eeb09af798ff89c122cab0389b867fa95b1857629a1b42165b3db1f08a53
Instruction Fuzzy Hash: 4071F1B17042008BE715DF29C884B16BFD8AF86715F1882BFE945AB3D2D6B8CD41C789

Uniqueness

Uniqueness Score: -1.00%

Function 004A8383, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004A8383(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t17;
				struct HWND__* _t21;
				struct HWND__* _t22;
				struct HWND__* _t25;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t36;
				intOrPtr _t39;
				int _t40;
				intOrPtr _t41;
				intOrPtr _t43;
				struct HWND__* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				intOrPtr _t60;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				void* _t73;
				void* _t74;

				_t74 = __eflags;
				_t72 = __esi;
				_t71 = __edi;
				_t52 = __ebx;
				_pop(_t62);
				 *[fs:eax] = _t62;
				_t17 =  *0x4b3718; // 0x0
				 *0x4b3718 = 0;
				E00405CC8(_t17);
				_t21 = E0040E748(0, L"STATIC", 0,  *0x4b0634, 0, 0, 0, 0, 0, 0, 0); // executed
				 *0x4ac450 = _t21;
				_t22 =  *0x4ac450; // 0x3802c0
				 *0x4b3710 = SetWindowLongW(_t22, 0xfffffffc, E004A13B0);
				_t25 =  *0x4ac450; // 0x3802c0
				 *(_t73 - 0x58) = _t25;
				 *((char*)(_t73 - 0x54)) = 0;
				_t26 =  *0x4b3720; // 0x4bc924
				_t4 = _t26 + 0x20; // 0x501b02
				 *((intOrPtr*)(_t73 - 0x50)) =  *_t4;
				 *((char*)(_t73 - 0x4c)) = 0;
				_t28 =  *0x4b3720; // 0x4bc924
				_t7 = _t28 + 0x24; // 0xb0200
				 *((intOrPtr*)(_t73 - 0x48)) =  *_t7;
				 *((char*)(_t73 - 0x44)) = 0;
				E0041A99C(L"/SL5=\"$%x,%d,%d,", 2, _t73 - 0x58, _t73 - 0x40);
				_push( *((intOrPtr*)(_t73 - 0x40)));
				_push( *0x4b3714);
				_push(E004A8660);
				E00422AB8(_t73 - 0x5c, __ebx, __esi, _t74);
				_push( *((intOrPtr*)(_t73 - 0x5c)));
				E004087A4(_t73 - 0x3c, __ebx, 4, __edi, __esi);
				_t36 =  *0x4b372c; // 0x0, executed
				E004A143C(_t36, _t52, 0x4ac44c,  *((intOrPtr*)(_t73 - 0x3c)), _t71, _t72, __fp0); // executed
				if( *0x4ac448 != 0xffffffff) {
					_t50 =  *0x4ac448; // 0x0
					E004A1320(_t50);
				}
				_pop(_t68);
				 *[fs:eax] = _t68;
				_push(E004A8534);
				_t39 =  *0x4b3718; // 0x0
				_t40 = E00405CC8(_t39);
				if( *0x4b372c != 0) {
					_t70 =  *0x4b372c; // 0x0
					_t40 = E004A0ECC(0, _t70, 0xfa, 0x32); // executed
				}
				if( *0x4b3724 != 0) {
					_t47 =  *0x4b3724; // 0x0
					_t40 = RemoveDirectoryW(E004084C8(_t47)); // executed
				}
				if( *0x4ac450 != 0) {
					_t46 =  *0x4ac450; // 0x3802c0
					_t40 = DestroyWindow(_t46); // executed
				}
				if( *0x4b3708 != 0) {
					_t41 =  *0x4b3708; // 0x0
					_t60 =  *0x4b370c; // 0xf
					_t69 =  *0x426aa4; // 0x426aa8
					E00408DAC(_t41, _t60, _t69);
					_t43 =  *0x4b3708; // 0x0
					E0040540C(_t43);
					 *0x4b3708 = 0;
					return 0;
				}
				return _t40;
			}

0x004a8383
0x004a8383
0x004a8383
0x004a8383
0x004a8385
0x004a8388
0x004a83b3
0x004a83ba
0x004a83c0
0x004a83e7
0x004a83ec
0x004a83f8
0x004a8403
0x004a840c
0x004a8411
0x004a8414
0x004a8418
0x004a841d
0x004a8420
0x004a8423
0x004a8427
0x004a842c
0x004a842f
0x004a8432
0x004a8443
0x004a8448
0x004a844b
0x004a8451
0x004a8459
0x004a845e
0x004a8469
0x004a8476
0x004a847b
0x004a8487
0x004a8489
0x004a848e
0x004a848e
0x004a8495
0x004a8498
0x004a849b
0x004a84a0
0x004a84a5
0x004a84b1
0x004a84bf
0x004a84c7
0x004a84c7
0x004a84d3
0x004a84d5
0x004a84e0
0x004a84e0
0x004a84ec
0x004a84ee
0x004a84f4
0x004a84f4
0x004a8500
0x004a8502
0x004a8507
0x004a850d
0x004a8513
0x004a8518
0x004a851d
0x004a8524
0x00000000
0x004a8524
0x004a8529

APIs

Part of subcall function 0040E748: CreateWindowExW.USER32 ref: 0040E787

SetWindowLongW.USER32 ref: 004A83FE

Part of subcall function 00422AB8: GetCommandLineW.KERNEL32(00000000,00422AFA,?,?,00000000,?,004A845E,004A8660,?), ref: 00422ACE

Part of subcall function 004A143C: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004A153C,00000000,004A152C,00000000,004A1511), ref: 004A14AC
Part of subcall function 004A143C: CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004A153C,00000000,004A152C,00000000), ref: 004A14C0
Part of subcall function 004A143C: MsgWaitForMultipleObjects.USER32 ref: 004A14D9
Part of subcall function 004A143C: GetExitCodeProcess.KERNEL32 ref: 004A14ED
Part of subcall function 004A143C: CloseHandle.KERNEL32(?,?,004AC44C,00000001,?,00000000,000000FF,000004FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004A14F6

RemoveDirectoryW.KERNEL32(00000000,004A8534), ref: 004A84E0
DestroyWindow.USER32(003802C0,004A8534), ref: 004A84F4

Strings

STATIC, xrefs: 004A83E0
/SL5="$%x,%d,%d,, xrefs: 004A843E
InnoSetupLdrWindow, xrefs: 004A83DB

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: a11fbe756f7f2081050fdb452eeb39d84f723be55f3184d7a3272a2ac561a8e7
Instruction ID: ad17a008a8a74016f0247325cd10a11e66cc17c3673bb36b701d74231778c7e7
Opcode Fuzzy Hash: a11fbe756f7f2081050fdb452eeb39d84f723be55f3184d7a3272a2ac561a8e7
Instruction Fuzzy Hash: F3416FB4A042049FDB14DFAAED95B597BF0E76A305F10863AE4009B2A1DF78AD41CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 004A143C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E004A143C(void* __eax, void* __ebx, DWORD* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				struct _STARTUPINFOW _v76;
				void* _v88;
				void* _v92;
				int _t23;
				intOrPtr _t49;
				DWORD* _t51;
				void* _t56;

				_v8 = 0;
				_t51 = __ecx;
				_t53 = __edx;
				_t41 = __eax;
				_push(_t56);
				_push(0x4a1511);
				_push( *[fs:eax]);
				 *[fs:eax] = _t56 + 0xffffffa8;
				_push(0x4a152c);
				_push(__eax);
				_push(E004A153C);
				_push(__edx);
				E004087A4( &_v8, __eax, 4, __ecx, __edx);
				E00405864( &_v76, 0x44);
				_v76.cb = 0x44;
				_t23 = CreateProcessW(0, E004084C8(_v8), 0, 0, 0, 0, 0, 0,  &_v76,  &_v92); // executed
				_t58 = _t23;
				if(_t23 == 0) {
					E004A1064(0x72, _t41, 0, _t53, _t58);
				}
				CloseHandle(_v88);
				do {
					E004A1410();
				} while (MsgWaitForMultipleObjects(1,  &_v92, 0, 0xffffffff, 0x4ff) == 1);
				E004A1410();
				GetExitCodeProcess(_v92, _t51); // executed
				CloseHandle(_v92);
				_pop(_t49);
				 *[fs:eax] = _t49;
				_push(E004A1518);
				return E004079F4( &_v8);
			}

0x004a1447
0x004a144a
0x004a144c
0x004a144e
0x004a1452
0x004a1453
0x004a1458
0x004a145b
0x004a145e
0x004a1463
0x004a1464
0x004a1469
0x004a1472
0x004a1481
0x004a1486
0x004a14ac
0x004a14b1
0x004a14b3
0x004a14b7
0x004a14b7
0x004a14c0
0x004a14c5
0x004a14c5
0x004a14de
0x004a14e3
0x004a14ed
0x004a14f6
0x004a14fd
0x004a1500
0x004a1503
0x004a1510

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004A153C,00000000,004A152C,00000000,004A1511), ref: 004A14AC
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004A153C,00000000,004A152C,00000000), ref: 004A14C0
MsgWaitForMultipleObjects.USER32 ref: 004A14D9
GetExitCodeProcess.KERNEL32 ref: 004A14ED
CloseHandle.KERNEL32(?,?,004AC44C,00000001,?,00000000,000000FF,000004FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004A14F6

Part of subcall function 004A1064: GetLastError.KERNEL32(00000000,004A110B,?,?,00000000), ref: 004A1087

Strings

D, xrefs: 004A1486

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 3f53cdb1fe7aa8bb8f06de78268ae7764ae86d97b50b59418d3b709dbb49c709
Instruction ID: 47d237310cf9ec714f0c62a9dd1f60edaf51b76bd8e3ac122ecf0cee1fcf75e2
Opcode Fuzzy Hash: 3f53cdb1fe7aa8bb8f06de78268ae7764ae86d97b50b59418d3b709dbb49c709
Instruction Fuzzy Hash: 6211A571A442087ADB00EBE68C42F9F7BACDF59714F50453BB604E72D2DA789900862D

Uniqueness

Uniqueness Score: -1.00%

Function 004A7A8C, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E004A7A8C(void* __ebx, void* __ecx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _t16;
				intOrPtr _t32;
				intOrPtr _t41;

				_t27 = __ebx;
				_push(0);
				_push(0);
				_push(0);
				_push(_t41);
				_push(0x4a7b56);
				_push( *[fs:eax]);
				 *[fs:eax] = _t41;
				 *0x4b30d4 =  *0x4b30d4 - 1;
				if( *0x4b30d4 < 0) {
					 *0x4b30d8 = E0040E4A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"Wow64DisableWow64FsRedirection");
					 *0x4b30dc = E0040E4A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"Wow64RevertWow64FsRedirection");
					if( *0x4b30d8 == 0 ||  *0x4b30dc == 0) {
						_t16 = 0;
					} else {
						_t16 = 1;
					}
					 *0x4b30e0 = _t16;
					E00422C38( &_v12);
					E00422554(_v12,  &_v8);
					E004086C4( &_v8, L"shell32.dll");
					E00421124(_v8, _t27, 0x8000); // executed
					E004231E0(0x4c783afb,  &_v16);
				}
				_pop(_t32);
				 *[fs:eax] = _t32;
				_push(0x4a7b5d);
				return E00407A54( &_v16, 3);
			}

0x004a7a8c
0x004a7a8f
0x004a7a91
0x004a7a93
0x004a7a97
0x004a7a98
0x004a7a9d
0x004a7aa0
0x004a7aa3
0x004a7aaa
0x004a7ac5
0x004a7adf
0x004a7aeb
0x004a7af6
0x004a7afa
0x004a7afa
0x004a7afa
0x004a7afc
0x004a7b04
0x004a7b0f
0x004a7b1c
0x004a7b29
0x004a7b36
0x004a7b36
0x004a7b3d
0x004a7b40
0x004a7b43
0x004a7b55

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004A7B56,?,00000000,00000000,00000000), ref: 004A7ABA

Part of subcall function 0040E4A8: GetProcAddress.KERNEL32(?,0B), ref: 0040E4D2

GetModuleHandleW.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004A7B56,?,00000000,00000000,00000000), ref: 004A7AD4

Part of subcall function 0040E4A8: GetProcAddress.KERNEL32(?,00000000), ref: 0040E50B

Strings

Wow64DisableWow64FsRedirection, xrefs: 004A7AB0
kernel32.dll, xrefs: 004A7AB5, 004A7ACF
Wow64RevertWow64FsRedirection, xrefs: 004A7ACA
shell32.dll, xrefs: 004A7B17

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: d416b1431fee2575f17526f7277d42f002a328a02d6f7a5176ac1df516150c71
Instruction ID: 2c4302aebef363acd514d918e3102629efdcfdb161d7c116b5a2cbd6c4c890f7
Opcode Fuzzy Hash: d416b1431fee2575f17526f7277d42f002a328a02d6f7a5176ac1df516150c71
Instruction Fuzzy Hash: 8B118270708204BFD720FB67DC52B5D77A4DB6A708FA0887BE40066291DA7C6A459A3D

Uniqueness

Uniqueness Score: -1.00%

Function 00403EE8, Relevance: 9.0, APIs: 7, Instructions: 298
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00403EE8(signed int __eax) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* _t96;
				void** _t99;
				signed int _t104;
				signed int _t109;
				signed int _t110;
				intOrPtr* _t114;
				void* _t116;
				void* _t121;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				unsigned int _t141;
				signed int _t142;
				void* _t144;
				void* _t147;
				intOrPtr _t148;
				signed int _t150;
				long _t156;
				intOrPtr _t159;
				signed int _t162;

				_t95 = __eax;
				_t129 =  *0x4ad059; // 0x0
				if(__eax > 0xa2c) {
					__eflags = __eax - 0x40a2c;
					if(__eax > 0x40a2c) {
						_pop(_t120);
						__eflags = __eax;
						if(__eax >= 0) {
							_push(_t120);
							_t162 = __eax;
							_t2 = _t162 + 0x10010; // 0x10110
							_t156 = _t2 - 0x00000001 + 0x00000004 & 0xffff0000;
							_t96 = VirtualAlloc(0, _t156, 0x101000, 4); // executed
							_t121 = _t96;
							if(_t121 != 0) {
								_t147 = _t121;
								 *((intOrPtr*)(_t147 + 8)) = _t162;
								 *(_t147 + 0xc) = _t156 | 0x00000004;
								E00403C48();
								_t99 =  *0x4afb80; // 0x4afb7c
								 *_t147 = 0x4afb7c;
								 *0x4afb80 = _t121;
								 *(_t147 + 4) = _t99;
								 *_t99 = _t121;
								 *0x4afb78 = 0;
								_t121 = _t121 + 0x10;
							}
							return _t121;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t67 = _t95 + 0xd3; // 0x1d3
						_t125 = (_t67 & 0xffffff00) + 0x30;
						__eflags = _t129;
						if(__eflags != 0) {
							while(1) {
								asm("lock cmpxchg [0x4adae8], ah");
								if(__eflags == 0) {
									goto L42;
								}
								asm("pause");
								__eflags =  *0x4ad989;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									asm("lock cmpxchg [0x4adae8], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L42;
							}
						}
						L42:
						_t68 = _t125 - 0xb30; // -2445
						_t141 = _t68;
						_t142 = _t141 >> 0xd;
						_t131 = _t141 >> 8;
						_t104 = 0xffffffff << _t131 &  *(0x4adaf8 + _t142 * 4);
						__eflags = 0xffffffff;
						if(0xffffffff == 0) {
							_t132 = _t142;
							__eflags = 0xfffffffe << _t132 &  *0x4adaf4;
							if((0xfffffffe << _t132 &  *0x4adaf4) == 0) {
								_t133 =  *0x4adaf0; // 0x0
								_t134 = _t133 - _t125;
								__eflags = _t134;
								if(_t134 < 0) {
									_t109 = E00403BCC(_t125);
								} else {
									_t110 =  *0x4adaec; // 0x26dfd80
									_t109 = _t110 - _t125;
									 *0x4adaec = _t109;
									 *0x4adaf0 = _t134;
									 *(_t109 - 4) = _t125 | 0x00000002;
								}
								 *0x4adae8 = 0;
								return _t109;
							} else {
								asm("bsf edx, eax");
								asm("bsf ecx, eax");
								_t135 = _t132 | _t142 << 0x00000005;
								goto L50;
							}
						} else {
							asm("bsf eax, eax");
							_t135 = _t131 & 0xffffffe0 | _t104;
							L50:
							_push(_t152);
							_push(_t145);
							_t148 = 0x4adb78 + _t135 * 8;
							_t159 =  *((intOrPtr*)(_t148 + 4));
							_t114 =  *((intOrPtr*)(_t159 + 4));
							 *((intOrPtr*)(_t148 + 4)) = _t114;
							 *_t114 = _t148;
							__eflags = _t148 - _t114;
							if(_t148 == _t114) {
								asm("rol eax, cl");
								_t80 = 0x4adaf8 + _t142 * 4;
								 *_t80 =  *(0x4adaf8 + _t142 * 4) & 0xfffffffe;
								__eflags =  *_t80;
								if( *_t80 == 0) {
									asm("btr [0x4adaf4], edx");
								}
							}
							_t150 = 0xfffffff0 &  *(_t159 - 4);
							_t144 = 0xfffffff0 - _t125;
							__eflags = 0xfffffff0;
							if(0xfffffff0 == 0) {
								_t89 =  &((_t159 - 4)[0xfffffffffffffffc]);
								 *_t89 =  *(_t159 - 4 + _t150) & 0x000000f7;
								__eflags =  *_t89;
							} else {
								_t116 = _t125 + _t159;
								 *((intOrPtr*)(_t116 - 4)) = 0xfffffffffffffff3;
								 *(0xfffffff0 + _t116 - 8) = 0xfffffff0;
								__eflags = 0xfffffff0 - 0xb30;
								if(0xfffffff0 >= 0xb30) {
									E00403B00(_t116, 0xfffffffffffffff3, _t144);
								}
							}
							_t93 = _t125 + 2; // 0x1a5
							 *(_t159 - 4) = _t93;
							 *0x4adae8 = 0;
							return _t159;
						}
					}
				} else {
					__eflags = __cl;
					_t6 = __edx + 0x4ad990; // 0xc8c8c8c8
					__eax =  *_t6 & 0x000000ff;
					__ebx = 0x4a9080 + ( *_t6 & 0x000000ff) * 8;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L5;
							}
							__ebx = __ebx + 0x20;
							__eflags = __ebx;
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__ebx != 0) {
								__ebx = __ebx + 0x20;
								__eflags = __ebx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__ebx != 0) {
									__ebx = __ebx - 0x40;
									asm("pause");
									__eflags =  *0x4ad989;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [ebx], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
								}
							}
							goto L5;
						}
					}
					L5:
					__edx =  *(__ebx + 8);
					__eax =  *(__edx + 0x10);
					__ecx = 0xfffffff8;
					__eflags = __edx - __ebx;
					if(__edx == __ebx) {
						__edx =  *(__ebx + 0x18);
						__ecx =  *(__ebx + 2) & 0x0000ffff;
						__ecx = ( *(__ebx + 2) & 0x0000ffff) + __eax;
						__eflags = __eax -  *(__ebx + 0x14);
						if(__eax >  *(__ebx + 0x14)) {
							_push(__esi);
							_push(__edi);
							__eflags =  *0x4ad059;
							if(__eflags != 0) {
								while(1) {
									__eax = 0x100;
									asm("lock cmpxchg [0x4adae8], ah");
									if(__eflags == 0) {
										goto L22;
									}
									asm("pause");
									__eflags =  *0x4ad989;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [0x4adae8], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
									goto L22;
								}
							}
							L22:
							 *(__ebx + 1) =  *(__ebx + 1) &  *0x4adaf4;
							__eflags =  *(__ebx + 1) &  *0x4adaf4;
							if(( *(__ebx + 1) &  *0x4adaf4) == 0) {
								__ecx =  *(__ebx + 4) & 0x0000ffff;
								__edi =  *0x4adaf0; // 0x0
								__eflags = __edi - ( *(__ebx + 4) & 0x0000ffff);
								if(__edi < ( *(__ebx + 4) & 0x0000ffff)) {
									__eax =  *(__ebx + 6) & 0x0000ffff;
									__edi = __eax;
									__eax = E00403BCC(__eax);
									__esi = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										goto L35;
									} else {
										 *0x4adae8 = __al;
										 *__ebx = __al;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										return __eax;
									}
								} else {
									__esi =  *0x4adaec; // 0x26dfd80
									__ecx =  *(__ebx + 6) & 0x0000ffff;
									__edx = __ecx + 0xb30;
									__eflags = __edi - __ecx + 0xb30;
									if(__edi >= __ecx + 0xb30) {
										__edi = __ecx;
									}
									__esi = __esi - __edi;
									 *0x4adaf0 =  *0x4adaf0 - __edi;
									 *0x4adaec = __esi;
									goto L35;
								}
							} else {
								asm("bsf eax, esi");
								__esi = __eax * 8;
								__ecx =  *(0x4adaf8 + __eax * 4);
								asm("bsf ecx, ecx");
								__ecx =  *(0x4adaf8 + __eax * 4) + __eax * 8 * 4;
								__edi = 0x4adb78 + ( *(0x4adaf8 + __eax * 4) + __eax * 8 * 4) * 8;
								__esi =  *(__edi + 4);
								__edx =  *(__esi + 4);
								 *(__edi + 4) = __edx;
								 *__edx = __edi;
								__eflags = __edi - __edx;
								if(__edi == __edx) {
									__edx = 0xfffffffe;
									asm("rol edx, cl");
									_t38 = 0x4adaf8 + __eax * 4;
									 *_t38 =  *(0x4adaf8 + __eax * 4) & 0xfffffffe;
									__eflags =  *_t38;
									if( *_t38 == 0) {
										asm("btr [0x4adaf4], eax");
									}
								}
								__edi = 0xfffffff0;
								__edi = 0xfffffff0 &  *(__esi - 4);
								__eflags = 0xfffffff0 - 0x10a60;
								if(0xfffffff0 < 0x10a60) {
									_t52 =  &((__esi - 4)[0xfffffffffffffffc]);
									 *_t52 = (__esi - 4)[0xfffffffffffffffc] & 0x000000f7;
									__eflags =  *_t52;
								} else {
									__edx = __edi;
									__edi =  *(__ebx + 6) & 0x0000ffff;
									__edx = __edx - __edi;
									__eax = __edi + __esi;
									__ecx = __edx + 3;
									 *(__eax - 4) = __ecx;
									 *(__edx + __eax - 8) = __edx;
									__eax = E00403B00(__eax, __ecx, __edx);
								}
								L35:
								_t56 = __edi + 6; // 0x6
								__ecx = _t56;
								 *(__esi - 4) = _t56;
								__eax = 0;
								 *0x4adae8 = __al;
								 *__esi = __ebx;
								 *((intOrPtr*)(__esi + 0x10)) = 0;
								 *((intOrPtr*)(__esi + 0x14)) = 1;
								 *(__ebx + 0x18) = __esi;
								_t61 = __esi + 0x20; // 0x26dfda0
								__eax = _t61;
								__ecx =  *(__ebx + 2) & 0x0000ffff;
								__edx = __ecx + __eax;
								 *(__ebx + 0x10) = __ecx + __eax;
								__edi = __edi + __esi;
								__edi = __edi - __ecx;
								__eflags = __edi;
								 *(__ebx + 0x14) = __edi;
								 *__ebx = 0;
								 *(__eax - 4) = __esi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						} else {
							_t19 = __edx + 0x14;
							 *_t19 =  *(__edx + 0x14) + 1;
							__eflags =  *_t19;
							 *(__ebx + 0x10) = __ecx;
							 *__ebx = 0;
							 *(__eax - 4) = __edx;
							_pop(__ebx);
							return __eax;
						}
					} else {
						 *(__edx + 0x14) =  *(__edx + 0x14) + 1;
						__ecx = 0xfffffff8 &  *(__eax - 4);
						__eflags = 0xfffffff8;
						 *(__edx + 0x10) = 0xfffffff8 &  *(__eax - 4);
						 *(__eax - 4) = __edx;
						if(0xfffffff8 == 0) {
							__ecx =  *(__edx + 8);
							 *(__ecx + 0xc) = __ebx;
							 *(__ebx + 8) = __ecx;
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						} else {
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x00403ee8
0x00403ef4
0x00403efa
0x00404148
0x0040414d
0x00404260
0x00404261
0x00404263
0x00403c94
0x00403c98
0x00403c9a
0x00403ca4
0x00403cb4
0x00403cb9
0x00403cbd
0x00403cbf
0x00403cc1
0x00403cc7
0x00403cca
0x00403ccf
0x00403cd4
0x00403cda
0x00403ce0
0x00403ce3
0x00403ce5
0x00403cec
0x00403cec
0x00403cf5
0x00404269
0x00404269
0x0040426b
0x0040426b
0x00404153
0x00404153
0x0040415f
0x00404162
0x00404164
0x0040410c
0x00404111
0x00404119
0x00000000
0x00000000
0x0040411b
0x0040411d
0x00404124
0x00000000
0x00404126
0x00404128
0x00404132
0x0040413a
0x0040413e
0x00000000
0x0040413e
0x0040413a
0x00000000
0x00404124
0x0040410c
0x00404166
0x00404166
0x00404166
0x0040416e
0x00404171
0x0040417b
0x0040417b
0x00404182
0x00404195
0x00404199
0x0040419f
0x004041b8
0x004041be
0x004041be
0x004041c0
0x004041de
0x004041c2
0x004041c2
0x004041c7
0x004041c9
0x004041ce
0x004041d7
0x004041d7
0x004041e3
0x004041eb
0x004041a1
0x004041a1
0x004041ab
0x004041b3
0x00000000
0x004041b3
0x00404184
0x00404187
0x0040418a
0x004041ec
0x004041ec
0x004041ed
0x004041ee
0x004041f5
0x004041f8
0x004041fb
0x004041fe
0x00404200
0x00404202
0x00404209
0x0040420b
0x0040420b
0x0040420b
0x00404212
0x00404214
0x00404214
0x00404212
0x00404220
0x00404225
0x00404225
0x00404227
0x00404248
0x00404248
0x00404248
0x00404229
0x00404229
0x0040422f
0x00404232
0x00404236
0x0040423c
0x0040423e
0x0040423e
0x0040423c
0x0040424d
0x00404250
0x00404253
0x0040425f
0x0040425f
0x00404182
0x00403f00
0x00403f00
0x00403f02
0x00403f02
0x00403f09
0x00403f10
0x00403f68
0x00403f68
0x00403f6d
0x00403f71
0x00000000
0x00000000
0x00403f73
0x00403f73
0x00403f76
0x00403f7b
0x00403f7f
0x00403f81
0x00403f81
0x00403f84
0x00403f89
0x00403f8d
0x00403f8f
0x00403f92
0x00403f94
0x00403f9b
0x00000000
0x00403f9d
0x00403f9f
0x00403fa4
0x00403fa9
0x00403fad
0x00403fb5
0x00000000
0x00403fb5
0x00403fad
0x00403f9b
0x00403f8d
0x00000000
0x00403f7f
0x00403f68
0x00403f12
0x00403f12
0x00403f15
0x00403f18
0x00403f1d
0x00403f1f
0x00403f38
0x00403f3b
0x00403f3f
0x00403f41
0x00403f44
0x00403fbc
0x00403fbd
0x00403fbe
0x00403fc5
0x00403fc7
0x00403fc7
0x00403fcc
0x00403fd4
0x00000000
0x00000000
0x00403fd6
0x00403fd8
0x00403fdf
0x00000000
0x00403fe1
0x00403fe3
0x00403fe8
0x00403fed
0x00403ff5
0x00403ff9
0x00000000
0x00403ff9
0x00403ff5
0x00000000
0x00403fdf
0x00403fc7
0x00404000
0x00404004
0x00404004
0x0040400a
0x0040407c
0x00404080
0x00404086
0x00404088
0x004040b0
0x004040b4
0x004040b6
0x004040bb
0x004040bd
0x004040bf
0x00000000
0x004040c1
0x004040c1
0x004040c6
0x004040c8
0x004040c9
0x004040ca
0x004040cb
0x004040cb
0x0040408a
0x0040408a
0x00404090
0x00404094
0x0040409a
0x0040409c
0x0040409e
0x0040409e
0x004040a0
0x004040a2
0x004040a8
0x00000000
0x004040a8
0x0040400c
0x0040400c
0x0040400f
0x00404016
0x0040401d
0x00404020
0x00404023
0x0040402a
0x0040402d
0x00404030
0x00404033
0x00404035
0x00404037
0x00404039
0x0040403e
0x00404040
0x00404040
0x00404040
0x00404047
0x00404049
0x00404049
0x00404047
0x00404050
0x00404055
0x00404058
0x0040405e
0x004040cc
0x004040cc
0x004040cc
0x00404060
0x00404060
0x00404062
0x00404066
0x00404068
0x0040406b
0x0040406e
0x00404071
0x00404075
0x00404075
0x004040d1
0x004040d1
0x004040d1
0x004040d4
0x004040d7
0x004040d9
0x004040de
0x004040e0
0x004040e3
0x004040ea
0x004040ed
0x004040ed
0x004040f0
0x004040f4
0x004040f7
0x004040fa
0x004040fc
0x004040fc
0x004040fe
0x00404101
0x00404104
0x00404107
0x00404108
0x00404109
0x0040410a
0x0040410a
0x00403f46
0x00403f46
0x00403f46
0x00403f46
0x00403f4a
0x00403f4d
0x00403f50
0x00403f53
0x00403f54
0x00403f54
0x00403f21
0x00403f21
0x00403f25
0x00403f25
0x00403f28
0x00403f2b
0x00403f2e
0x00403f58
0x00403f5b
0x00403f5e
0x00403f61
0x00403f64
0x00403f65
0x00403f30
0x00403f30
0x00403f33
0x00403f34
0x00403f34
0x00403f2e
0x00403f1f

APIs

Sleep.KERNEL32(00000000,000000FF,00404788,00000000,0040BF5B,00000000,0040C469,00000000,0040C72B,00000000,0040C761), ref: 00403F9F
Sleep.KERNEL32(0000000A,00000000,000000FF,00404788,00000000,0040BF5B,00000000,0040C469,00000000,0040C72B,00000000,0040C761), ref: 00403FB5
Sleep.KERNEL32(00000000,00000000,?,000000FF,00404788,00000000,0040BF5B,00000000,0040C469,00000000,0040C72B,00000000,0040C761), ref: 00403FE3
Sleep.KERNEL32(0000000A,00000000,00000000,?,000000FF,00404788,00000000,0040BF5B,00000000,0040C469,00000000,0040C72B,00000000,0040C761), ref: 00403FF9

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: de0d06ab3528a7223025f1b9446eacc1668a16eaa8b8f8de44a1672ae8a3e8ae
Instruction ID: 40858f6e4be6ca8b0a26f9524243d71a381fde2c256961902b301cd5bde9a830
Opcode Fuzzy Hash: de0d06ab3528a7223025f1b9446eacc1668a16eaa8b8f8de44a1672ae8a3e8ae
Instruction Fuzzy Hash: F6C146B2A052118BCB19CF68E884356BFE4ABC6311F1882BFE516AB7D1C774D941C79C

Uniqueness

Uniqueness Score: -1.00%

Function 004A80CC, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E004A80CC(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t26;
				intOrPtr _t31;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				intOrPtr _t44;
				intOrPtr _t47;
				intOrPtr _t51;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t61;
				WCHAR* _t63;
				intOrPtr _t69;
				intOrPtr _t74;
				int _t75;
				intOrPtr _t76;
				intOrPtr _t78;
				struct HWND__* _t81;
				intOrPtr _t82;
				intOrPtr _t86;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				void* _t120;
				intOrPtr _t121;

				_t119 = __esi;
				_t118 = __edi;
				_t85 = __ebx;
				_pop(_t101);
				_pop(_t88);
				 *[fs:eax] = _t101;
				E004A138C(_t88);
				if( *0x4ac440 == 0) {
					if(( *0x4b3701 & 0x00000001) == 0 &&  *0x4ac441 == 0) {
						_t61 =  *0x4ac674; // 0x4b2d04
						_t4 = _t61 + 0x2b4; // 0x0
						_t63 = E004084C8( *_t4);
						_t88 = _t120 - 0x28;
						_t101 =  *0x4b35d8; // 0x0
						E00426DFC(0xb1, _t120 - 0x28, _t101);
						if(MessageBoxW(0, E004084C8( *((intOrPtr*)(_t120 - 0x28))), _t63, 0x24) != 6) {
							 *0x4ac44c = 2;
							E0041F358();
						}
					}
					E004056B0();
					E004A0D04(_t120 - 0x2c, _t85, _t101, _t118, _t119); // executed
					E00407DD4(0x4b3724,  *((intOrPtr*)(_t120 - 0x2c)));
					_t26 =  *0x4b3714; // 0x0
					E00422848(_t26, _t88, _t120 - 0x34);
					E004225BC( *((intOrPtr*)(_t120 - 0x34)), _t85, _t120 - 0x30, L".tmp", _t118, _t119);
					_push( *((intOrPtr*)(_t120 - 0x30)));
					_t31 =  *0x4b3724; // 0x0
					E00422554(_t31, _t120 - 0x38);
					_pop(_t90);
					E0040871C(0x4b3728, _t90,  *((intOrPtr*)(_t120 - 0x38)));
					_t107 =  *0x4b3728; // 0x0
					E00407DD4(0x4b372c, _t107);
					_t37 =  *0x4b3720; // 0x4bc924
					_t15 = _t37 + 0x14; // 0x51aed6
					_t38 =  *0x4b3718; // 0x0
					E00423BDC(_t38,  *_t15);
					_push(_t120);
					_push(0x4a838d);
					_push( *[fs:edx]);
					 *[fs:edx] = _t121;
					 *0x4b3770 = 0;
					_t42 = E00423BF4(1, 0, 1, 0); // executed
					 *0x4b371c = _t42;
					_push(_t120);
					_push(0x4a837c);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t44 =  *0x4b3720; // 0x4bc924
					_t16 = _t44 + 0x18; // 0x26b000
					 *0x4b3770 = E004053F0( *_t16);
					_t47 =  *0x4b3720; // 0x4bc924
					_t17 = _t47 + 0x18; // 0x26b000
					_t86 =  *0x4b3770; // 0x7fc40010
					E00405864(_t86,  *_t17);
					_push(_t120);
					_push(0x4a82cb);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t51 =  *0x424bcc; // 0x424c24
					_t93 =  *0x4b3718; // 0x0
					_t53 = E0042463C(_t93, 1, _t51); // executed
					 *0x4b3774 = _t53;
					_push(_t120);
					_push(0x4a82ba);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t55 =  *0x4b3720; // 0x4bc924
					_t18 = _t55 + 0x18; // 0x26b000
					_t56 =  *0x4b3774; // 0x26efeb0
					E00424918(_t56,  *_t18, _t86);
					_pop(_t114);
					 *[fs:eax] = _t114;
					_push(E004A82C1);
					_t59 =  *0x4b3774; // 0x26efeb0
					return E00405CC8(_t59);
				} else {
					_t69 =  *0x4ac674; // 0x4b2d04
					_t1 = _t69 + 0x18c; // 0x0
					E004A1754( *_t1, __ebx, __edi, __esi);
					 *0x4ac44c = 0;
					_pop(_t115);
					 *[fs:eax] = _t115;
					_push(E004A8534);
					_t74 =  *0x4b3718; // 0x0
					_t75 = E00405CC8(_t74);
					if( *0x4b372c != 0) {
						_t117 =  *0x4b372c; // 0x0
						_t75 = E004A0ECC(0, _t117, 0xfa, 0x32); // executed
					}
					if( *0x4b3724 != 0) {
						_t82 =  *0x4b3724; // 0x0
						_t75 = RemoveDirectoryW(E004084C8(_t82)); // executed
					}
					if( *0x4ac450 != 0) {
						_t81 =  *0x4ac450; // 0x3802c0
						_t75 = DestroyWindow(_t81); // executed
					}
					if( *0x4b3708 != 0) {
						_t76 =  *0x4b3708; // 0x0
						_t99 =  *0x4b370c; // 0xf
						_t116 =  *0x426aa4; // 0x426aa8
						E00408DAC(_t76, _t99, _t116);
						_t78 =  *0x4b3708; // 0x0
						E0040540C(_t78);
						 *0x4b3708 = 0;
						return 0;
					}
					return _t75;
				}
			}

0x004a80cc
0x004a80cc
0x004a80cc
0x004a80ce
0x004a80d0
0x004a80d1
0x004a80f1
0x004a80fd
0x004a8122
0x004a812f
0x004a8134
0x004a813a
0x004a8140
0x004a8143
0x004a814b
0x004a8163
0x004a8165
0x004a816f
0x004a816f
0x004a8163
0x004a8174
0x004a817c
0x004a8189
0x004a8191
0x004a8196
0x004a81a6
0x004a81ae
0x004a81b2
0x004a81b7
0x004a81c4
0x004a81c5
0x004a81cf
0x004a81d5
0x004a81da
0x004a81df
0x004a81e2
0x004a81e7
0x004a81ee
0x004a81ef
0x004a81f4
0x004a81f7
0x004a81fc
0x004a8214
0x004a8219
0x004a8220
0x004a8221
0x004a8226
0x004a8229
0x004a822c
0x004a8231
0x004a8239
0x004a823e
0x004a8243
0x004a8246
0x004a8250
0x004a8257
0x004a8258
0x004a825d
0x004a8260
0x004a8263
0x004a8269
0x004a8276
0x004a827b
0x004a8282
0x004a8283
0x004a8288
0x004a828b
0x004a828e
0x004a8293
0x004a8298
0x004a829d
0x004a82a4
0x004a82a7
0x004a82aa
0x004a82af
0x004a82b9
0x004a80ff
0x004a80ff
0x004a8104
0x004a810a
0x004a8111
0x004a8495
0x004a8498
0x004a849b
0x004a84a0
0x004a84a5
0x004a84b1
0x004a84bf
0x004a84c7
0x004a84c7
0x004a84d3
0x004a84d5
0x004a84e0
0x004a84e0
0x004a84ec
0x004a84ee
0x004a84f4
0x004a84f4
0x004a8500
0x004a8502
0x004a8507
0x004a850d
0x004a8513
0x004a8518
0x004a851d
0x004a8524
0x00000000
0x004a8524
0x004a8529
0x004a8529

APIs

MessageBoxW.USER32(00000000,00000000,00000000,00000024), ref: 004A815B

Part of subcall function 004A1754: MessageBoxW.USER32(00000000,00000000,Setup,00000010), ref: 004A17BE

RemoveDirectoryW.KERNEL32(00000000,004A8534), ref: 004A84E0
DestroyWindow.USER32(003802C0,004A8534), ref: 004A84F4

Part of subcall function 004A0ECC: Sleep.KERNEL32(?,?,?,?,0000000D,?,004A84CC,000000FA,00000032,004A8534), ref: 004A0EEB
Part of subcall function 004A0ECC: GetLastError.KERNEL32(?,?,?,0000000D,?,004A84CC,000000FA,00000032,004A8534), ref: 004A0F0E
Part of subcall function 004A0ECC: GetLastError.KERNEL32(?,?,?,0000000D,?,004A84CC,000000FA,00000032,004A8534), ref: 004A0F18

Strings

.tmp, xrefs: 004A81A1
$LB, xrefs: 004A8263

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorLastMessage$DestroyDirectoryRemoveSleepWindow
String ID: $LB$.tmp
API String ID: 3858953238-2116547132
Opcode ID: f43bd58ab390326026b5c830374453e98346b79b57d4fe5b5190d731510edfc5
Instruction ID: f755fe4bfd509cc25c2ddd0c8339d8558b2a0affd53895b10bdf613ffe7a07dc
Opcode Fuzzy Hash: f43bd58ab390326026b5c830374453e98346b79b57d4fe5b5190d731510edfc5
Instruction Fuzzy Hash: 92615BF4640240AFDB11EF6AEC92A567BE5E75A305F50867AF800973A1CE38AD41CB1C

Uniqueness

Uniqueness Score: -1.00%

Function 00407724, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00407724() {
				void* _t20;
				void* _t23;
				intOrPtr _t31;
				intOrPtr* _t33;
				void* _t46;
				struct HINSTANCE__* _t49;
				void* _t56;

				if( *0x4a9004 != 0) {
					E00407604();
					E0040768C(_t46);
					 *0x4a9004 = 0;
				}
				if( *0x4afbcc != 0 && GetCurrentThreadId() ==  *0x4afbf4) {
					E0040735C(0x4afbc8);
					E00407660(0x4afbc8);
				}
				if( *0x004AFBC0 != 0 ||  *0x4ad054 == 0) {
					L8:
					if( *((char*)(0x4afbc0)) == 2 &&  *0x4a9000 == 0) {
						 *0x004AFBA4 = 0;
					}
					if( *((char*)(0x4afbc0)) != 0) {
						L14:
						E00407384();
						if( *((char*)(0x4afbc0)) <= 1 ||  *0x4a9000 != 0) {
							_t15 =  *0x004AFBA8;
							if( *0x004AFBA8 != 0) {
								E0040B780(_t15);
								_t31 =  *((intOrPtr*)(0x4afba8));
								_t8 = _t31 + 0x10; // 0x400000
								_t49 =  *_t8;
								_t9 = _t31 + 4; // 0x400000
								if(_t49 !=  *_t9 && _t49 != 0) {
									FreeLibrary(_t49);
								}
							}
						}
						E0040735C(0x4afb98);
						if( *((char*)(0x4afbc0)) == 1) {
							 *0x004AFBBC();
						}
						if( *((char*)(0x4afbc0)) != 0) {
							E00407660(0x4afb98);
						}
						if( *0x4afb98 == 0) {
							if( *0x4ad038 != 0) {
								 *0x4ad038();
							}
							ExitProcess( *0x4a9000); // executed
						}
						memcpy(0x4afb98,  *0x4afb98, 0xc << 2);
						_t56 = _t56 + 0xc;
						0x4a9000 = 0x4a9000;
						0x4afb98 = 0x4afb98;
						goto L8;
					} else {
						_t20 = E00405494();
						_t44 = _t20;
						if(_t20 == 0) {
							goto L14;
						} else {
							goto L13;
						}
						do {
							L13:
							E00405CC8(_t44);
							_t23 = E00405494();
							_t44 = _t23;
						} while (_t23 != 0);
						goto L14;
					}
				} else {
					do {
						_t33 =  *0x4ad054; // 0x0
						 *0x4ad054 = 0;
						 *_t33();
					} while ( *0x4ad054 != 0);
					L8:
					while(1) {
					}
				}
			}

0x00407738
0x0040773a
0x0040773f
0x00407746
0x00407746
0x00407752
0x00407766
0x00407770
0x00407770
0x00407779
0x0040779d
0x004077a1
0x004077aa
0x004077aa
0x004077b1
0x004077d0
0x004077d0
0x004077d9
0x004077e0
0x004077e5
0x004077e7
0x004077ec
0x004077ef
0x004077ef
0x004077f2
0x004077f5
0x004077fc
0x004077fc
0x004077f5
0x004077e5
0x00407803
0x0040780c
0x0040780e
0x0040780e
0x00407815
0x00407819
0x00407819
0x00407821
0x0040782a
0x0040782c
0x0040782c
0x00407835
0x00407835
0x00407847
0x00407847
0x00407849
0x0040784a
0x00000000
0x004077b3
0x004077b3
0x004077b8
0x004077bc
0x00000000
0x00000000
0x00000000
0x00000000
0x004077be
0x004077be
0x004077c0
0x004077c5
0x004077ca
0x004077cc
0x00000000
0x004077be
0x00407784
0x00407784
0x00407784
0x0040778d
0x00407792
0x00407794
0x00000000
0x0040779d
0x00000000
0x0040779d

APIs

GetCurrentThreadId.KERNEL32 ref: 00407754
FreeLibrary.KERNEL32(00400000,?,?,?,0040785E,004054DF,00405526,?,?,0040553F,?,?,?,?,0045354A,00000000), ref: 004077FC
ExitProcess.KERNEL32(00000000,?,?,?,0040785E,004054DF,00405526,?,?,0040553F,?,?,?,?,0045354A,00000000), ref: 00407835

Part of subcall function 0040768C: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?,0040785E,004054DF,00405526,?,?,0040553F), ref: 004076C5
Part of subcall function 0040768C: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?,0040785E,004054DF,00405526,?,?), ref: 004076CB
Part of subcall function 0040768C: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?), ref: 004076E6
Part of subcall function 0040768C: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?), ref: 004076EC

Strings

MZP, xrefs: 004077FB

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 27687baf6def8bf591ad0f3cbfb324307bfd436381f9ba0853c27a150f62d65a
Instruction ID: 4d6c15ac86d8b360ffdfc55aea4b1fc84de7d629047560fa0690051ca5318a6c
Opcode Fuzzy Hash: 27687baf6def8bf591ad0f3cbfb324307bfd436381f9ba0853c27a150f62d65a
Instruction Fuzzy Hash: DA319220E086415AE731AB79C48875B7AE46B06358F14883BD441A37D2D77CF884CB6F

Uniqueness

Uniqueness Score: -1.00%

Function 0040771C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0040771C() {
				intOrPtr* _t14;
				void* _t23;
				void* _t26;
				intOrPtr _t34;
				intOrPtr* _t36;
				void* _t50;
				struct HINSTANCE__* _t53;
				void* _t62;

				 *((intOrPtr*)(_t14 +  *_t14)) =  *((intOrPtr*)(_t14 +  *_t14)) + _t14 +  *_t14;
				if( *0x4a9004 != 0) {
					E00407604();
					E0040768C(_t50);
					 *0x4a9004 = 0;
				}
				if( *0x4afbcc != 0 && GetCurrentThreadId() ==  *0x4afbf4) {
					E0040735C(0x4afbc8);
					E00407660(0x4afbc8);
				}
				if( *0x004AFBC0 != 0 ||  *0x4ad054 == 0) {
					L9:
					if( *((char*)(0x4afbc0)) == 2 &&  *0x4a9000 == 0) {
						 *0x004AFBA4 = 0;
					}
					if( *((char*)(0x4afbc0)) != 0) {
						L15:
						E00407384();
						if( *((char*)(0x4afbc0)) <= 1 ||  *0x4a9000 != 0) {
							_t18 =  *0x004AFBA8;
							if( *0x004AFBA8 != 0) {
								E0040B780(_t18);
								_t34 =  *((intOrPtr*)(0x4afba8));
								_t8 = _t34 + 0x10; // 0x400000
								_t53 =  *_t8;
								_t9 = _t34 + 4; // 0x400000
								if(_t53 !=  *_t9 && _t53 != 0) {
									FreeLibrary(_t53);
								}
							}
						}
						E0040735C(0x4afb98);
						if( *((char*)(0x4afbc0)) == 1) {
							 *0x004AFBBC();
						}
						if( *((char*)(0x4afbc0)) != 0) {
							E00407660(0x4afb98);
						}
						if( *0x4afb98 == 0) {
							if( *0x4ad038 != 0) {
								 *0x4ad038();
							}
							ExitProcess( *0x4a9000); // executed
						}
						memcpy(0x4afb98,  *0x4afb98, 0xc << 2);
						_t62 = _t62 + 0xc;
						0x4a9000 = 0x4a9000;
						0x4afb98 = 0x4afb98;
						goto L9;
					} else {
						_t23 = E00405494();
						_t48 = _t23;
						if(_t23 == 0) {
							goto L15;
						} else {
							goto L14;
						}
						do {
							L14:
							E00405CC8(_t48);
							_t26 = E00405494();
							_t48 = _t26;
						} while (_t26 != 0);
						goto L15;
					}
				} else {
					do {
						_t36 =  *0x4ad054; // 0x0
						 *0x4ad054 = 0;
						 *_t36();
					} while ( *0x4ad054 != 0);
					L9:
					while(1) {
					}
				}
			}

0x0040771e
0x00407738
0x0040773a
0x0040773f
0x00407746
0x00407746
0x00407752
0x00407766
0x00407770
0x00407770
0x00407779
0x0040779d
0x004077a1
0x004077aa
0x004077aa
0x004077b1
0x004077d0
0x004077d0
0x004077d9
0x004077e0
0x004077e5
0x004077e7
0x004077ec
0x004077ef
0x004077ef
0x004077f2
0x004077f5
0x004077fc
0x004077fc
0x004077f5
0x004077e5
0x00407803
0x0040780c
0x0040780e
0x0040780e
0x00407815
0x00407819
0x00407819
0x00407821
0x0040782a
0x0040782c
0x0040782c
0x00407835
0x00407835
0x00407847
0x00407847
0x00407849
0x0040784a
0x00000000
0x004077b3
0x004077b3
0x004077b8
0x004077bc
0x00000000
0x00000000
0x00000000
0x00000000
0x004077be
0x004077be
0x004077c0
0x004077c5
0x004077ca
0x004077cc
0x00000000
0x004077be
0x00407784
0x00407784
0x00407784
0x0040778d
0x00407792
0x00407794
0x00000000
0x0040779d
0x00000000
0x0040779d

APIs

GetCurrentThreadId.KERNEL32 ref: 00407754
FreeLibrary.KERNEL32(00400000,?,?,?,0040785E,004054DF,00405526,?,?,0040553F,?,?,?,?,0045354A,00000000), ref: 004077FC
ExitProcess.KERNEL32(00000000,?,?,?,0040785E,004054DF,00405526,?,?,0040553F,?,?,?,?,0045354A,00000000), ref: 00407835

Part of subcall function 0040768C: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?,0040785E,004054DF,00405526,?,?,0040553F), ref: 004076C5
Part of subcall function 0040768C: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?,0040785E,004054DF,00405526,?,?), ref: 004076CB
Part of subcall function 0040768C: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?), ref: 004076E6
Part of subcall function 0040768C: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?), ref: 004076EC

Strings

MZP, xrefs: 004077FB

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: c0169702aa9a0112fec964110138e5601fa374416d594b0021619e1349d772d7
Instruction ID: 94527550a85b6d0efb8c992dbc1059f00de0a519c92a8f1d7b957efcc6585d4e
Opcode Fuzzy Hash: c0169702aa9a0112fec964110138e5601fa374416d594b0021619e1349d772d7
Instruction Fuzzy Hash: 8E315C20E087419AE731AB79848875B3BE06B16358F14883BE441A77D2D77CF884CB6F

Uniqueness

Uniqueness Score: -1.00%

Function 004A0D04, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E004A0D04(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char* _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				int _t30;
				intOrPtr _t63;
				void* _t71;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t76;

				_t71 = __edi;
				_t54 = __ebx;
				_t75 = _t76;
				_t55 = 4;
				do {
					_push(0);
					_push(0);
					_t55 = _t55 - 1;
				} while (_t55 != 0);
				_push(_t55);
				_push(__ebx);
				_t73 = __eax;
				_t78 = 0;
				_push(_t75);
				_push(0x4a0df9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t76;
				while(1) {
					E00422C64( &_v12, _t54, _t55, _t78); // executed
					_t55 = L".tmp";
					E004A0BE8(0, _t54, L".tmp", _v12, _t71, _t73,  &_v8); // executed
					_t30 = CreateDirectoryW(E004084C8(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t54 = GetLastError();
					_t78 = _t54 - 0xb7;
					if(_t54 != 0xb7) {
						E00426DFC(0x3b,  &_v32, _v8);
						_v28 = _v32;
						E00419F38( &_v36, _t54, 0);
						_v24 = _v36;
						E004231E0(_t54,  &_v40);
						_v20 = _v40;
						E00426DCC(0x70, 2,  &_v28,  &_v16);
						_t55 = _v16;
						E0041F384(_v16, 1);
						E004070F0();
					}
				}
				E00407DD4(_t73, _v8);
				__eflags = 0;
				_pop(_t63);
				 *[fs:eax] = _t63;
				_push(E004A0E00);
				E00407A54( &_v40, 3);
				return E00407A54( &_v16, 3);
			}

0x004a0d04
0x004a0d04
0x004a0d05
0x004a0d07
0x004a0d0c
0x004a0d0c
0x004a0d0e
0x004a0d10
0x004a0d10
0x004a0d13
0x004a0d14
0x004a0d16
0x004a0d18
0x004a0d1a
0x004a0d1b
0x004a0d20
0x004a0d23
0x004a0d26
0x004a0d2d
0x004a0d35
0x004a0d3c
0x004a0d4c
0x004a0d53
0x00000000
0x00000000
0x004a0d5a
0x004a0d5c
0x004a0d62
0x004a0d70
0x004a0d78
0x004a0d84
0x004a0d8c
0x004a0d94
0x004a0d9c
0x004a0da9
0x004a0dae
0x004a0db8
0x004a0dbd
0x004a0dbd
0x004a0d62
0x004a0dcc
0x004a0dd1
0x004a0dd3
0x004a0dd6
0x004a0dd9
0x004a0de6
0x004a0df8

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,004A0DF9,?,?,?,00000003,00000000,00000000,?,004A8181), ref: 004A0D4C
GetLastError.KERNEL32(00000000,00000000,?,00000000,004A0DF9,?,?,?,00000003,00000000,00000000,?,004A8181), ref: 004A0D55

Strings

.tmp, xrefs: 004A0D35
$OA, xrefs: 004A0DB3

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: $OA$.tmp
API String ID: 1375471231-3378223631
Opcode ID: c1f69d4ac7ed32912a2b85f44ff5ab6aba8f1595c1b5cc6fac2d72c7c5252cf6
Instruction ID: b2ec1cbb6bf4e9aaf38cbd7c23de4c70b0fa0b963ef3ce0e2719d642a434da45
Opcode Fuzzy Hash: c1f69d4ac7ed32912a2b85f44ff5ab6aba8f1595c1b5cc6fac2d72c7c5252cf6
Instruction Fuzzy Hash: 04217675A002099FDB00EBA1C841ADFB3B9EB59304F50457BF901B7381DA786E058B69

Uniqueness

Uniqueness Score: -1.00%

Function 004A7000, Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E004A7000(void* __ecx, void* __edx) {
				intOrPtr _t19;
				intOrPtr _t22;

				_push(_t22);
				_push(0x4a70d7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t22;
				 *0x4ad98c =  *0x4ad98c - 1;
				if( *0x4ad98c < 0) {
					E00405B54();
					E004051A8();
					SetThreadLocale(0x400); // executed
					E0040A5C4();
					 *0x4a900c = 2;
					 *0x4ad01c = 0x4036b0;
					 *0x4ad020 = 0x4036b8;
					 *0x4ad05a = 2;
					 *0x4ad060 = E0040CDE0();
					 *0x4ad008 = E004098F4;
					E00405BAC(E00405B90());
					 *0x4ad068 = 0xd7b0;
					 *0x4ad344 = 0xd7b0;
					 *0x4ad620 = 0xd7b0;
					 *0x4ad050 = GetCommandLineW();
					 *0x4ad04c = E00403810();
					 *0x4ad97c = GetACP();
					 *0x4ad980 = 0x4b0;
					 *0x4ad044 = GetCurrentThreadId();
					E0040CDF4();
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(0x4a70de);
				return 0;
			}

0x004a7005
0x004a7006
0x004a700b
0x004a700e
0x004a7011
0x004a7018
0x004a701e
0x004a7023
0x004a702d
0x004a7032
0x004a7037
0x004a703e
0x004a7048
0x004a7052
0x004a705e
0x004a7063
0x004a7072
0x004a7077
0x004a7080
0x004a7089
0x004a7097
0x004a70a1
0x004a70ab
0x004a70b0
0x004a70bf
0x004a70c4
0x004a70c4
0x004a70cb
0x004a70ce
0x004a70d1
0x004a70d6

APIs

SetThreadLocale.KERNEL32(00000400,00000000,004A70D7), ref: 004A702D

Part of subcall function 0040A5C4: InitializeCriticalSection.KERNEL32(004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A5C9
Part of subcall function 0040A5C4: GetVersion.KERNEL32(004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A5D7
Part of subcall function 0040A5C4: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A5FE
Part of subcall function 0040A5C4: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A604
Part of subcall function 0040A5C4: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A618
Part of subcall function 0040A5C4: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A61E
Part of subcall function 0040A5C4: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A632
Part of subcall function 0040A5C4: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A638

Part of subcall function 0040CDE0: GetSystemInfo.KERNEL32 ref: 0040CDE4

GetCommandLineW.KERNEL32(00000400,00000000,004A70D7), ref: 004A7092

Part of subcall function 00403810: GetStartupInfoW.KERNEL32 ref: 00403821

GetACP.KERNEL32(00000400,00000000,004A70D7), ref: 004A70A6
GetCurrentThreadId.KERNEL32 ref: 004A70BA

Part of subcall function 0040CDF4: GetVersion.KERNEL32(004A70C9,00000400,00000000,004A70D7), ref: 0040CDF4

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: 751076c4bcae2fa5cb3ef74472dc0559afb380b7e743fee50856c719e0d04cff
Instruction ID: 2d6e9566c0f1ba9e301420735f22e2aaacda25799cb94ec5fa4b9a8b87f6e037
Opcode Fuzzy Hash: 751076c4bcae2fa5cb3ef74472dc0559afb380b7e743fee50856c719e0d04cff
Instruction Fuzzy Hash: EC1100B0808740A9E711BF72AC0660A3FA8FB4770DF41883EE10567AA2D7BD5545DF6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E748, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040E748(long __eax, WCHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				WCHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				WCHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E00405720();
				_t24 = CreateWindowExW(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00405710(_t13);
				return _t24;
			}

0x0040e74f
0x0040e754
0x0040e756
0x0040e787
0x0040e790
0x0040e79c

APIs

CreateWindowExW.USER32 ref: 0040E787

Strings

STATIC, xrefs: 0040E785
InnoSetupLdrWindow, xrefs: 0040E74B

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateWindow
String ID: InnoSetupLdrWindow$STATIC
API String ID: 716092398-2209255943
Opcode ID: 308ffab18e31b1134490d17498aac611e849f0f3c6d244726fd98e92013085e1
Instruction ID: f84a80031f046bc7831efab5cf97239724a0ea78ac17ff57204b8c6211417fe6
Opcode Fuzzy Hash: 308ffab18e31b1134490d17498aac611e849f0f3c6d244726fd98e92013085e1
Instruction Fuzzy Hash: 59F097B6600118BF8B40DE9DDC85DDB77ECEB4C264B054529FA0CD3201D634ED108BB4

Uniqueness

Uniqueness Score: -1.00%

Function 004A0ECC, Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004A0ECC(long __eax, intOrPtr __edx, long _a4, long _a8) {
				intOrPtr _v8;
				long _t5;
				long _t9;
				void* _t10;
				void* _t13;
				void* _t15;
				void* _t16;

				_t5 = __eax;
				_v8 = __edx;
				_t9 = __eax;
				_t15 = _t10 - 1;
				if(_t15 < 0) {
					L10:
					return _t5;
				}
				_t16 = _t15 + 1;
				_t13 = 0;
				while(1) {
					_t19 = _t13 - 1;
					if(_t13 != 1) {
						__eflags = _t13 - 1;
						if(__eflags > 0) {
							Sleep(_a4);
						}
					} else {
						Sleep(_a8);
					}
					_t5 = E00427040(_t9, _v8, _t19); // executed
					if(_t5 != 0) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 2) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 3) {
						goto L10;
					}
					_t13 = _t13 + 1;
					_t16 = _t16 - 1;
					if(_t16 != 0) {
						continue;
					}
					goto L10;
				}
				goto L10;
			}

0x004a0ecc
0x004a0ed3
0x004a0ed6
0x004a0eda
0x004a0edd
0x004a0f2b
0x004a0f2b
0x004a0f2b
0x004a0edf
0x004a0ee0
0x004a0ee2
0x004a0ee2
0x004a0ee5
0x004a0ef2
0x004a0ef5
0x004a0efb
0x004a0efb
0x004a0ee7
0x004a0eeb
0x004a0eeb
0x004a0f05
0x004a0f0c
0x00000000
0x00000000
0x004a0f0e
0x004a0f16
0x00000000
0x00000000
0x004a0f18
0x004a0f20
0x00000000
0x00000000
0x004a0f22
0x004a0f23
0x004a0f24
0x00000000
0x00000000
0x00000000
0x004a0f24
0x00000000

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,004A84CC,000000FA,00000032,004A8534), ref: 004A0EEB
Sleep.KERNEL32(?,?,?,?,0000000D,?,004A84CC,000000FA,00000032,004A8534), ref: 004A0EFB
GetLastError.KERNEL32(?,?,?,0000000D,?,004A84CC,000000FA,00000032,004A8534), ref: 004A0F0E
GetLastError.KERNEL32(?,?,?,0000000D,?,004A84CC,000000FA,00000032,004A8534), ref: 004A0F18

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: cc2d4a94ccb7c0f067045319ffe32a9e8ea37e82b0256121e0719bcc797ceef4
Instruction ID: fcbe09275aa41918487a0acd76f4d80e315746382495138c44c41daec09aced7
Opcode Fuzzy Hash: cc2d4a94ccb7c0f067045319ffe32a9e8ea37e82b0256121e0719bcc797ceef4
Instruction Fuzzy Hash: A9F02B32B002241B6B30E95E9C4592F628CDAB7378B10052FF545E7302D4BDCC4152E8

Uniqueness

Uniqueness Score: -1.00%

Function 00420060, Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00420060(void* __eax, void* __ebx, signed int* __ecx, signed int* __edx, void* __edi, void* __esi, signed int* _a4) {
				char _v8;
				char _v9;
				int _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _t33;
				int _t43;
				int _t64;
				intOrPtr _t72;
				intOrPtr _t74;
				signed int* _t77;
				signed int* _t79;
				void* _t81;
				void* _t82;
				intOrPtr _t83;

				_t81 = _t82;
				_t83 = _t82 + 0xffffffe8;
				_v8 = 0;
				_t77 = __ecx;
				_t79 = __edx;
				_push(_t81);
				_push(0x420160);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				_v9 = 0;
				E00407E1C( &_v8, __eax);
				E00407F84( &_v8);
				_t33 = GetFileVersionInfoSizeW(E004084C8(_v8),  &_v16); // executed
				_t64 = _t33;
				if(_t64 == 0) {
					_pop(_t72);
					 *[fs:eax] = _t72;
					_push(0x420167);
					return E004079F4( &_v8);
				} else {
					_v20 = E004053F0(_t64);
					_push(_t81);
					_push(0x420143);
					_push( *[fs:edx]);
					 *[fs:edx] = _t83;
					_t43 = GetFileVersionInfoW(E004084C8(_v8), _v16, _t64, _v20); // executed
					if(_t43 != 0 && VerQueryValueW(_v20, 0x420174,  &_v24,  &_v28) != 0) {
						 *_t79 =  *(_v24 + 0x10) >> 0x00000010 & 0x0000ffff;
						 *_t77 =  *(_v24 + 0x10) & 0x0000ffff;
						 *_a4 =  *(_v24 + 0x14) >> 0x00000010 & 0x0000ffff;
						_v9 = 1;
					}
					_pop(_t74);
					 *[fs:eax] = _t74;
					_push(0x42014a);
					return E0040540C(_v20);
				}
			}

0x00420061
0x00420063
0x0042006b
0x0042006e
0x00420070
0x00420076
0x00420077
0x0042007c
0x0042007f
0x00420082
0x0042008b
0x00420093
0x004200a5
0x004200aa
0x004200ae
0x0042014c
0x0042014f
0x00420152
0x0042015f
0x004200b4
0x004200bb
0x004200c0
0x004200c1
0x004200c6
0x004200c9
0x004200de
0x004200e5
0x0042010d
0x00420116
0x00420127
0x00420129
0x00420129
0x0042012f
0x00420132
0x00420135
0x00420142
0x00420142

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00420160), ref: 004200A5
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00420143,?,00000000,?,00000000,00420160), ref: 004200DE
VerQueryValueW.VERSION(?,00420174,?,?,00000000,?,00000000,?,00000000,00420143,?,00000000,?,00000000,00420160), ref: 004200F8

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: d183af1ef0636e6162bc8df42a0a4f5a0591cd6bdf26b12374301618c02b16f2
Instruction ID: 7a7f4719427165232ba07bab02eb7f8b2be03f671c4adb6f55d937d41512f1e4
Opcode Fuzzy Hash: d183af1ef0636e6162bc8df42a0a4f5a0591cd6bdf26b12374301618c02b16f2
Instruction Fuzzy Hash: 69312171A042199FDB01DFA9D9419BFB7F8EB48300B9144BAF404E3292DB79DD10D765

Uniqueness

Uniqueness Score: -1.00%

Function 0040B484, Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B484(intOrPtr __eax, void* __ebx, signed int __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t41;
				signed short _t43;
				signed short _t46;
				signed int _t60;
				intOrPtr _t68;
				void* _t79;
				signed int* _t81;
				intOrPtr _t84;

				_t79 = __edi;
				_t61 = __ecx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t81 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00407AD8(_v8);
				E00407AD8(_v12);
				_push(_t84);
				_push(0x40b59b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E004079F4(__ecx);
				if(_v12 == 0) {
					L14:
					_pop(_t68);
					 *[fs:eax] = _t68;
					_push(E0040B5A2);
					return E00407A54( &_v28, 6);
				}
				E00407E1C( &_v20, _v12);
				_t41 = _v12;
				if(_t41 != 0) {
					_t41 =  *(_t41 - 4);
				}
				_t60 = _t41;
				if(_t60 < 1) {
					L7:
					_t43 = E0040B1A8(_v8, _t60, _t61,  &_v16, _t81); // executed
					if(_v16 == 0) {
						L00403730();
						E0040AB58(_t43, _t60,  &_v24, _t79, _t81);
						_t46 = E0040B2D4(_v20, _t60, _t81, _v24, _t79, _t81); // executed
						__eflags =  *_t81;
						if( *_t81 == 0) {
							__eflags =  *0x4afc0c;
							if( *0x4afc0c == 0) {
								L00403738();
								E0040AB58(_t46, _t60,  &_v28, _t79, _t81);
								E0040B2D4(_v20, _t60, _t81, _v28, _t79, _t81);
							}
						}
						__eflags =  *_t81;
						if(__eflags == 0) {
							E0040B3B8(_v20, _t60, _t81, __eflags); // executed
						}
					} else {
						E0040B2D4(_v20, _t60, _t81, _v16, _t79, _t81);
					}
					goto L14;
				}
				while( *((short*)(_v12 + _t60 * 2 - 2)) != 0x2e) {
					_t60 = _t60 - 1;
					__eflags = _t60;
					if(_t60 != 0) {
						continue;
					}
					goto L7;
				}
				_t61 = _t60;
				E0040888C(_v12, _t60, 1,  &_v20);
				goto L7;
			}

0x0040b484
0x0040b484
0x0040b487
0x0040b489
0x0040b48b
0x0040b48d
0x0040b48f
0x0040b491
0x0040b493
0x0040b494
0x0040b495
0x0040b497
0x0040b49a
0x0040b4a0
0x0040b4a8
0x0040b4af
0x0040b4b0
0x0040b4b5
0x0040b4b8
0x0040b4bd
0x0040b4c6
0x0040b580
0x0040b582
0x0040b585
0x0040b588
0x0040b59a
0x0040b59a
0x0040b4d2
0x0040b4d7
0x0040b4dc
0x0040b4e1
0x0040b4e1
0x0040b4e3
0x0040b4e8
0x0040b50f
0x0040b515
0x0040b51e
0x0040b52f
0x0040b537
0x0040b544
0x0040b549
0x0040b54c
0x0040b54e
0x0040b555
0x0040b557
0x0040b55f
0x0040b56c
0x0040b56c
0x0040b555
0x0040b571
0x0040b574
0x0040b57b
0x0040b57b
0x0040b520
0x0040b528
0x0040b528
0x00000000
0x0040b51e
0x0040b4ea
0x0040b50a
0x0040b50b
0x0040b50d
0x00000000
0x00000000
0x00000000
0x0040b50d
0x0040b4f9
0x0040b503
0x00000000

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040B59B,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040B622,00000000,?,00000105), ref: 0040B52F
GetSystemDefaultUILanguage.KERNEL32(00000000,0040B59B,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040B622,00000000,?,00000105), ref: 0040B557

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: a5df62239bc9b8b5aa42d2ad25163fdcfd826da8443722874e4a27fbb09cfcac
Instruction ID: 18846fc7009ae5a4e71a55a4188c0930fdf68c345da51b172561767d210bf349
Opcode Fuzzy Hash: a5df62239bc9b8b5aa42d2ad25163fdcfd826da8443722874e4a27fbb09cfcac
Instruction Fuzzy Hash: A5310170A10249ABDB10EF95C881AAEB7B5EF44308F5044BBE800B33D1D778AE458B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5A8, Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B5A8(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				short _v530;
				char _v536;
				char _v540;
				void* _t44;
				intOrPtr _t45;
				void* _t49;
				void* _t52;

				_v536 = 0;
				_v540 = 0;
				_v8 = 0;
				_t49 = __eax;
				_push(_t52);
				_push(0x40b662);
				_push( *[fs:eax]);
				 *[fs:eax] = _t52 + 0xfffffde8;
				GetModuleFileNameW(0,  &_v530, 0x105);
				E00408530( &_v536, _t49);
				_push(_v536);
				E0040856C( &_v540, 0x105,  &_v530);
				_pop(_t44); // executed
				E0040B484(_v540, 0,  &_v8, _t44, __edi, _t49); // executed
				if(_v8 != 0) {
					LoadLibraryExW(E004084C8(_v8), 0, 2);
				}
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(E0040B669);
				E00407A54( &_v540, 2);
				return E004079F4( &_v8);
			}

0x0040b5b5
0x0040b5bb
0x0040b5c1
0x0040b5c4
0x0040b5c8
0x0040b5c9
0x0040b5ce
0x0040b5d1
0x0040b5e4
0x0040b5f1
0x0040b5fc
0x0040b60e
0x0040b61c
0x0040b61d
0x0040b626
0x0040b635
0x0040b63a
0x0040b63e
0x0040b641
0x0040b644
0x0040b654
0x0040b661

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040B662,?,?,00000000), ref: 0040B5E4
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040B662,?,?,00000000), ref: 0040B635

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 71a3d84090ee24f64dbd202d4203489a3ae5a06853d229489dca3004faea58dc
Instruction ID: b80f15a0147bad070475b0dcf22c8b753a80f6822e4b0def75fc5cb61c98f3c2
Opcode Fuzzy Hash: 71a3d84090ee24f64dbd202d4203489a3ae5a06853d229489dca3004faea58dc
Instruction Fuzzy Hash: AC118270A4421CABDB14EB60CD86BDE77B8DB04704F5144BAF408B32D1DB785F848A99

Uniqueness

Uniqueness Score: -1.00%

Function 00427040, Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00427040(void* __eax, void* __edx, void* __eflags) {
				int _v8;
				char _v16;
				long _v20;
				int _t13;
				intOrPtr _t27;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t32 = _t34;
				_t35 = _t34 + 0xfffffff0;
				if(E00426FF4(__eax,  &_v16) != 0) {
					_push(_t32);
					_push(0x42709d);
					_push( *[fs:eax]);
					 *[fs:eax] = _t35;
					_t13 = DeleteFileW(E004084C8(__edx)); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(E004270A4);
					return E00427030( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00427041
0x00427043
0x00427058
0x00427063
0x00427064
0x00427069
0x0042706c
0x00427077
0x0042707c
0x00427084
0x00427089
0x0042708c
0x0042708f
0x0042709c
0x0042705a
0x0042705c
0x004270b5
0x004270b5

APIs

DeleteFileW.KERNEL32(00000000,00000000,0042709D,?,0000000D,00000000), ref: 00427077
GetLastError.KERNEL32(00000000,00000000,0042709D,?,0000000D,00000000), ref: 0042707F

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: a0fbf55be5ffcd09f305ae54ec4c1657f6674b1495f27545fe34e85a0120edfe
Instruction ID: 9cbfc24df38639fe3e45efe1b64bd3214acbd9b2112ca2de374008e0d0b065ce
Opcode Fuzzy Hash: a0fbf55be5ffcd09f305ae54ec4c1657f6674b1495f27545fe34e85a0120edfe
Instruction Fuzzy Hash: 54F0C831B08318ABDB00DB7AAC4189DB7E8DB49714B9149BBF814E3241EA785D144698

Uniqueness

Uniqueness Score: -1.00%

Function 00421124, Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00421124(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x421196);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x421178);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryW(E004084C8(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(0x42117f);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x00421125
0x00421127
0x0042112b
0x0042112e
0x00421133
0x00421138
0x00421139
0x0042113e
0x00421141
0x00421144
0x00421149
0x0042114a
0x0042114f
0x00421152
0x0042115d
0x00421162
0x00421167
0x0042116a
0x0042116d
0x00421172
0x00421174
0x00421177

APIs

SetErrorMode.KERNEL32 ref: 0042112E
LoadLibraryW.KERNEL32(00000000,00000000,00421178,?,00000000,00421196), ref: 0042115D

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 58c8085b5dd36ac0ba48c9e98c217b3e8311cd8d6350e3969bf77500e8c19a68
Instruction ID: 6692b858657e05fdd79fffc9be95ae21615ec1a40954b736760fd61b652abef3
Opcode Fuzzy Hash: 58c8085b5dd36ac0ba48c9e98c217b3e8311cd8d6350e3969bf77500e8c19a68
Instruction Fuzzy Hash: 05F08270A14744BEDB125F769C5283BBAACE71DB047924CB6F910A26D1E63D4820C568

Uniqueness

Uniqueness Score: -1.00%

Function 004052D4, Relevance: 2.6, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004052D4() {
				intOrPtr _t13;
				intOrPtr* _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;
				void* _t26;
				void* _t28;
				void* _t31;

				_t28 =  *0x004ADADC;
				while(_t28 != 0x4adad8) {
					_t2 = _t28 + 4; // 0x4adad8
					VirtualFree(_t28, 0, 0x8000); // executed
					_t28 =  *_t2;
				}
				_t25 = 0x37;
				_t13 = 0x4a9080;
				do {
					 *((intOrPtr*)(_t13 + 0xc)) = _t13;
					 *((intOrPtr*)(_t13 + 8)) = _t13;
					 *((intOrPtr*)(_t13 + 0x10)) = 1;
					 *((intOrPtr*)(_t13 + 0x14)) = 0;
					_t13 = _t13 + 0x20;
					_t25 = _t25 - 1;
				} while (_t25 != 0);
				 *0x4adad8 = 0x4adad8;
				 *0x004ADADC = 0x4adad8;
				_t26 = 0x400;
				_t23 = 0x4adb78;
				do {
					_t14 = _t23;
					 *_t14 = _t14;
					_t8 = _t14 + 4; // 0x4adb78
					 *_t8 = _t14;
					_t23 = _t23 + 8;
					_t26 = _t26 - 1;
				} while (_t26 != 0);
				 *0x4adaf4 = 0;
				E00405864(0x4adaf8, 0x80);
				_t18 = 0;
				 *0x4adaf0 = 0;
				_t31 =  *0x004AFB80;
				while(_t31 != 0x4afb7c) {
					_t10 = _t31 + 4; // 0x4afb7c
					_t18 = VirtualFree(_t31, 0, 0x8000);
					_t31 =  *_t10;
				}
				 *0x4afb7c = 0x4afb7c;
				 *0x004AFB80 = 0x4afb7c;
				return _t18;
			}

0x004052e2
0x004052f9
0x004052e7
0x004052f2
0x004052f7
0x004052f7
0x004052fd
0x00405302
0x00405307
0x00405309
0x0040530e
0x00405311
0x0040531a
0x0040531d
0x00405320
0x00405320
0x00405323
0x00405325
0x00405328
0x0040532d
0x00405332
0x00405332
0x00405334
0x00405336
0x00405336
0x00405339
0x0040533c
0x0040533c
0x00405341
0x00405352
0x00405357
0x00405359
0x0040535e
0x00405375
0x00405363
0x0040536e
0x00405373
0x00405373
0x00405379
0x0040537b
0x00405382

APIs

VirtualFree.KERNEL32(004ADAD8,00000000,00008000,?,?,?,?,004053D4,0040CEB2,00000000,0040CED0), ref: 004052F2
VirtualFree.KERNEL32(004AFB7C,00000000,00008000,004ADAD8,00000000,00008000,?,?,?,?,004053D4,0040CEB2,00000000,0040CED0), ref: 0040536E

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: aca56245cc52c82a7b3f341d1c8cf7e92a798c0e1fefa8615c437f19d7d6098e
Instruction ID: f25e8dfbfec68b3d20904660ccd9f243b5161469b6c6478f3192385b195fbe5f
Opcode Fuzzy Hash: aca56245cc52c82a7b3f341d1c8cf7e92a798c0e1fefa8615c437f19d7d6098e
Instruction Fuzzy Hash: BE1160B1A056008BC7689F199840B17BBE4EB89754F15C0BFE54AEB791D778AC01CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 004231E0, Relevance: 1.5, APIs: 1, Instructions: 28
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004231E0(long __eax, void* __edx) {
				short _v2052;
				signed int _t7;
				void* _t10;
				signed int _t16;
				void* _t17;

				_t10 = __edx;
				_t7 = FormatMessageW(0x3200, 0, __eax, 0,  &_v2052, 0x400, 0); // executed
				while(_t7 > 0) {
					_t16 =  *(_t17 + _t7 * 2 - 2) & 0x0000ffff;
					if(_t16 <= 0x20) {
						L1:
						_t7 = _t7 - 1;
						__eflags = _t7;
						continue;
					} else {
						_t20 = _t16 - 0x2e;
						if(_t16 == 0x2e) {
							goto L1;
						}
					}
					break;
				}
				return E00407B7C(_t10, _t7, _t17, _t20);
			}

0x004231e7
0x004231ff
0x00423207
0x0042320b
0x00423214
0x00423206
0x00423206
0x00423206
0x00000000
0x00423216
0x00423216
0x0042321a
0x00000000
0x00000000
0x0042321a
0x00000000
0x00423214
0x0042322d

APIs

FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,00423B12,00000000,00423B63,?,00423D1C), ref: 004231FF

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 8a8ded29896a6a3d6e4ee71bfed8fc8627356091e34a13b4e2479e8e8f3ea2c7
Instruction ID: 3693045bc5da979ae713bd01a88bcb338427aee45f74c8d87c3cec6a1377aca4
Opcode Fuzzy Hash: 8a8ded29896a6a3d6e4ee71bfed8fc8627356091e34a13b4e2479e8e8f3ea2c7
Instruction Fuzzy Hash: 6CE0D86079833162E32416495C03B77241AD7D0B02FE4443AB6509E3D6D6BDA959917E

Uniqueness

Uniqueness Score: -1.00%

Function 0042290C, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E0042290C(void* __eax, void* __ebx, void* __ecx, void* __eflags) {
				char _v8;
				intOrPtr _t21;
				intOrPtr _t24;

				_push(0);
				_push(_t24);
				_push(0x422952);
				_push( *[fs:eax]);
				 *[fs:eax] = _t24;
				E004228A0(__eax, __ecx,  &_v8, __eflags);
				GetFileAttributesW(E004084C8(_v8)); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(E00422959);
				return E004079F4( &_v8);
			}

0x0042290f
0x00422916
0x00422917
0x0042291c
0x0042291f
0x00422927
0x00422935
0x0042293e
0x00422941
0x00422944
0x00422951

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,00422952,?,?,00000000,?,00422965,00422CD6,00000000,00422D1B,?,?,00000000,00000000), ref: 00422935

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9695cc5852d01956a8356376f89e56037d2dc4f0e8c31fee9d54d063763669a7
Instruction ID: adf724cbc0e9ec99664fb7122883241a88969a7a5422e81553629d77d99d79d0
Opcode Fuzzy Hash: 9695cc5852d01956a8356376f89e56037d2dc4f0e8c31fee9d54d063763669a7
Instruction Fuzzy Hash: B1E09271704304BFE711EA72DD52A1AB7ACE788704FE1487AF500E3681EABCAE149558

Uniqueness

Uniqueness Score: -1.00%

Function 0040A31C, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A31C(void* __eax) {
				short _v532;
				void* __ebx;
				void* __esi;
				intOrPtr _t14;
				void* _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t16 = __eax;
				_t22 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					GetModuleFileNameW( *(__eax + 4),  &_v532, 0x20a);
					_t14 = E0040B5A8(_t21, _t16, _t18, _t19, _t22); // executed
					_t20 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t20;
					if(_t20 == 0) {
						 *((intOrPtr*)(_t16 + 0x10)) =  *((intOrPtr*)(_t16 + 4));
					}
				}
				return  *((intOrPtr*)(_t16 + 0x10));
			}

0x0040a324
0x0040a326
0x0040a32a
0x0040a33a
0x0040a343
0x0040a348
0x0040a34a
0x0040a34f
0x0040a354
0x0040a354
0x0040a34f
0x0040a362

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 0040A33A

Part of subcall function 0040B5A8: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040B662,?,?,00000000), ref: 0040B5E4
Part of subcall function 0040B5A8: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040B662,?,?,00000000), ref: 0040B635

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 7766ab1267648783c04a200b04eef592fad2a77fbeaae978ffe5e046441881e1
Instruction ID: 6edb2253a7495ed0a954c92edacff3916eacbd1be06b1290003ff9fd73c136a7
Opcode Fuzzy Hash: 7766ab1267648783c04a200b04eef592fad2a77fbeaae978ffe5e046441881e1
Instruction Fuzzy Hash: 87E0ED71A013109FCB10DE6CC8C5A5B77D8AB08758F0449A6AD68EF386D375DD2487D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423C9C, Relevance: 1.5, APIs: 1, Instructions: 26
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423C9C(signed int __ecx, void* __edx, signed char _a4, signed char _a8) {
				void* _t17;

				_t17 = CreateFileW(E004084C8(__edx),  *(0x4ab2e0 + (_a8 & 0x000000ff) * 4),  *(0x4ab2ec + (_a4 & 0x000000ff) * 4), 0,  *(0x4ab2fc + (__ecx & 0x000000ff) * 4), 0x80, 0); // executed
				return _t17;
			}

0x00423cd9
0x00423ce1

APIs

CreateFileW.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00423CD9

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cd066e086ef1ed4415b0417d4103bee30a162689a27a68c38112519e4c91ff9d
Instruction ID: 1c9d4f23c8aa800b19e68a1bac3b745927229ba282ea9ea95d81522d104b03bb
Opcode Fuzzy Hash: cd066e086ef1ed4415b0417d4103bee30a162689a27a68c38112519e4c91ff9d
Instruction Fuzzy Hash: 77E012622442282AD240969E7C51F667F9CD75A755F404063F984D72C2C5659A1086E8

Uniqueness

Uniqueness Score: -1.00%

Function 00423DCC, Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423DCC(intOrPtr* __eax) {
				int _t4;
				intOrPtr* _t7;

				_t7 = __eax;
				_t4 = SetEndOfFile( *(__eax + 4)); // executed
				if(_t4 == 0) {
					return E00423BA0( *_t7);
				}
				return _t4;
			}

0x00423dcd
0x00423dd3
0x00423dda
0x00000000
0x00423dde
0x00423de4

APIs

SetEndOfFile.KERNEL32(?,7FC40010,004A833A,00000000), ref: 00423DD3

Part of subcall function 00423BA0: GetLastError.KERNEL32(004236F0,00423C43,?,?,00000000,?,004A7F5A,00000001,00000000,00000002,00000000,004A857E,?,00000000,004A85C2), ref: 00423BA3

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 0765ad1251f4f9bf448c2ca066bd2935a303bcba73d1fbfb61790bf244085abd
Instruction ID: cfa778f694ab93f521f9cbfb4fa9891c4931fcabf1aeac7c02125d20c1f19662
Opcode Fuzzy Hash: 0765ad1251f4f9bf448c2ca066bd2935a303bcba73d1fbfb61790bf244085abd
Instruction Fuzzy Hash: EAC04C61710110478B40AEBAE9C1A1666E85A582057804866B504DB206E66DD9148618

Uniqueness

Uniqueness Score: -1.00%

Function 0040CDE0, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CDE0() {
				intOrPtr _v16;
				struct _SYSTEM_INFO* _t3;

				GetSystemInfo(_t3); // executed
				return _v16;
			}

0x0040cde4
0x0040cdf0

APIs

GetSystemInfo.KERNEL32 ref: 0040CDE4

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 64025997c8bef7f1ab34438094cc35a0f72d67f734e29c1609a2ef977955ad2c
Instruction ID: 4f21eec972071caf62eebbeb90550a79e4d7a8082c8b53f17589c9beddeb5e45
Opcode Fuzzy Hash: 64025997c8bef7f1ab34438094cc35a0f72d67f734e29c1609a2ef977955ad2c
Instruction Fuzzy Hash: CDA012984088002AC404AB194C4340F39C819C1114FC40224745CB62C2E61D866403DB

Uniqueness

Uniqueness Score: -1.00%

Function 00403BCC, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BCC(signed int __eax) {
				void* _t4;
				intOrPtr _t7;
				signed int _t8;
				void** _t10;
				void* _t12;
				void* _t14;

				_t8 = __eax;
				E00403B60(__eax);
				_t4 = VirtualAlloc(0, 0x13fff0, 0x1000, 4); // executed
				if(_t4 == 0) {
					 *0x4adaf0 = 0;
					return 0;
				} else {
					_t10 =  *0x4adadc; // 0x4adad8
					_t14 = _t4;
					 *_t14 = 0x4adad8;
					 *0x4adadc = _t4;
					 *(_t14 + 4) = _t10;
					 *_t10 = _t4;
					_t12 = _t14 + 0x13fff0;
					 *((intOrPtr*)(_t12 - 4)) = 2;
					 *0x4adaf0 = 0x13ffe0 - _t8;
					_t7 = _t12 - _t8;
					 *0x4adaec = _t7;
					 *(_t7 - 4) = _t8 | 0x00000002;
					return _t7;
				}
			}

0x00403bce
0x00403bd0
0x00403be3
0x00403bea
0x00403c3c
0x00403c45
0x00403bec
0x00403bec
0x00403bf2
0x00403bf4
0x00403bfa
0x00403bff
0x00403c02
0x00403c06
0x00403c11
0x00403c1e
0x00403c26
0x00403c28
0x00403c35
0x00403c39
0x00403c39

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,000001A3,004041E3,000000FF,00404788,00000000,0040BF5B,00000000,0040C469,00000000,0040C72B,00000000), ref: 00403BE3

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3bdf8bd4fda1bd36d4237db231ebe1dbc8cc1a3380dd60ea691b8e259bfce746
Instruction ID: 39403439fc8b110e22d936a7dc32f3b39bb41696391bc635e89da5ad8fc0de99
Opcode Fuzzy Hash: 3bdf8bd4fda1bd36d4237db231ebe1dbc8cc1a3380dd60ea691b8e259bfce746
Instruction Fuzzy Hash: 74F08CF2F082504FD7149F789D407417EE8E70A315B10817EE94AEBB95D7B488018B88

Uniqueness

Uniqueness Score: -1.00%

Function 00403CF6, Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00403CF6(void* __eax) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				void* _t13;
				int _t20;
				void* _t22;
				signed int _t26;
				signed int _t29;
				signed int _t30;
				void* _t34;
				intOrPtr _t35;
				signed int _t39;
				void* _t41;
				void* _t42;

				_push(_t29);
				_t42 = _t41 + 0xffffffdc;
				_t34 = __eax - 0x10;
				E00403C48();
				_t13 = _t34;
				 *_t42 =  *_t13;
				_v48 =  *((intOrPtr*)(_t13 + 4));
				_t26 =  *(_t13 + 0xc);
				if((_t26 & 0x00000008) != 0) {
					_t22 = _t34;
					_t39 = _t26 & 0xfffffff0;
					_t30 = 0;
					while(1) {
						VirtualQuery(_t22,  &_v44, 0x1c);
						if(VirtualFree(_t22, 0, 0x8000) == 0) {
							break;
						}
						_t35 = _v44.RegionSize;
						if(_t39 > _t35) {
							_t39 = _t39 - _t35;
							_t22 = _t22 + _t35;
							continue;
						}
						goto L10;
					}
					_t30 = _t30 | 0xffffffff;
				} else {
					_t20 = VirtualFree(_t34, 0, 0x8000); // executed
					if(_t20 == 0) {
						_t30 = _t29 | 0xffffffff;
					} else {
						_t30 = 0;
					}
				}
				L10:
				if(_t30 == 0) {
					 *_v48 =  *_t42;
					 *( *_t42 + 4) = _v48;
				}
				 *0x4afb78 = 0;
				return _t30;
			}

0x00403cfa
0x00403cfc
0x00403d01
0x00403d04
0x00403d09
0x00403d0d
0x00403d13
0x00403d17
0x00403d1d
0x00403d39
0x00403d3d
0x00403d40
0x00403d42
0x00403d4a
0x00403d5e
0x00000000
0x00000000
0x00403d65
0x00403d6b
0x00403d6d
0x00403d6f
0x00000000
0x00403d6f
0x00000000
0x00403d6b
0x00403d60
0x00403d1f
0x00403d27
0x00403d2e
0x00403d34
0x00403d30
0x00403d30
0x00403d30
0x00403d2e
0x00403d73
0x00403d75
0x00403d7e
0x00403d87
0x00403d87
0x00403d8a
0x00403d9a

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00403D27
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00403D4A
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00403D57

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: b0456c6339b53605163a229e0112fb3a82e8289d127bf0df54443eeb5f5b923e
Instruction ID: ad0733c8d53d3b26cd92df12ea1f8837c747f7844e5edc0d0b0e07a6a81a6a36
Opcode Fuzzy Hash: b0456c6339b53605163a229e0112fb3a82e8289d127bf0df54443eeb5f5b923e
Instruction Fuzzy Hash: 36F06D35304A005FD311DF1AC844B17BBE9EFC5711F15C57AE888973A1D635DD018796

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040AC9C, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040AC9C(short* __eax, intOrPtr __edx) {
				short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t50;
				signed int _t51;
				void* _t55;
				signed int _t88;
				signed int _t89;
				intOrPtr* _t90;
				signed int _t101;
				signed int _t102;
				short* _t112;
				struct HINSTANCE__* _t113;
				short* _t115;
				short* _t116;
				void* _t117;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t113 = GetModuleHandleW(L"kernel32.dll");
				if(_t113 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t115 = _v8 + 4;
						goto L10;
					} else {
						if( *((short*)(_v8 + 2)) == 0x5c) {
							_t116 = E0040AC78(_v8 + 4);
							if( *_t116 != 0) {
								_t14 = _t116 + 2; // 0x2
								_t115 = E0040AC78(_t14);
								if( *_t115 != 0) {
									L10:
									_t88 = _t115 - _v8;
									_t89 = _t88 >> 1;
									if(_t88 < 0) {
										asm("adc ebx, 0x0");
									}
									_t43 = _t89 + 1;
									if(_t89 + 1 <= 0x105) {
										E0040A6C0( &_v1134, _v8, _t43);
										while( *_t115 != 0) {
											_t112 = E0040AC78(_t115 + 2);
											_t50 = _t112 - _t115;
											_t51 = _t50 >> 1;
											if(_t50 < 0) {
												asm("adc eax, 0x0");
											}
											if(_t51 + _t89 + 1 <= 0x105) {
												_t55 =  &_v1134 + _t89 + _t89;
												_t101 = _t112 - _t115;
												_t102 = _t101 >> 1;
												if(_t101 < 0) {
													asm("adc edx, 0x0");
												}
												E0040A6C0(_t55, _t115, _t102 + 1);
												_v20 = FindFirstFileW( &_v1134,  &_v612);
												if(_v20 != 0xffffffff) {
													FindClose(_v20);
													if(lstrlenW( &(_v612.cFileName)) + _t89 + 1 + 1 <= 0x105) {
														 *((short*)(_t117 + _t89 * 2 - 0x46a)) = 0x5c;
														E0040A6C0( &_v1134 + _t89 + _t89 + 2,  &(_v612.cFileName), 0x105 - _t89 - 1);
														_t89 = _t89 + lstrlenW( &(_v612.cFileName)) + 1;
														_t115 = _t112;
														continue;
													}
												}
											}
											goto L24;
										}
										E0040A6C0(_v8,  &_v1134, _v12);
									}
								}
							}
						}
					}
				} else {
					_t90 = GetProcAddress(_t113, "GetLongPathNameW");
					if(_t90 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t90() == 0) {
							goto L4;
						} else {
							E0040A6C0(_v8,  &_v1134, _v12);
						}
					}
				}
				L24:
				return _v16;
			}

0x0040aca8
0x0040acab
0x0040acb1
0x0040acbe
0x0040acc2
0x0040ad01
0x0040ad08
0x0040ad48
0x00000000
0x0040ad0a
0x0040ad12
0x0040ad23
0x0040ad29
0x0040ad2f
0x0040ad37
0x0040ad3d
0x0040ad4b
0x0040ad4d
0x0040ad50
0x0040ad52
0x0040ad54
0x0040ad54
0x0040ad57
0x0040ad5f
0x0040ad70
0x0040ae37
0x0040ad82
0x0040ad86
0x0040ad88
0x0040ad8a
0x0040ad8c
0x0040ad8c
0x0040ad97
0x0040ada7
0x0040adab
0x0040adad
0x0040adaf
0x0040adb1
0x0040adb1
0x0040adb7
0x0040adcf
0x0040add6
0x0040addc
0x0040adf8
0x0040adfa
0x0040ae21
0x0040ae33
0x0040ae35
0x00000000
0x0040ae35
0x0040adf8
0x0040add6
0x00000000
0x0040ad97
0x0040ae4d
0x0040ae4d
0x0040ad5f
0x0040ad3d
0x0040ad29
0x0040ad12
0x0040acc4
0x0040accf
0x0040acd3
0x00000000
0x0040acd5
0x0040acd5
0x0040ace0
0x0040ace4
0x0040ace9
0x00000000
0x0040aceb
0x0040acf7
0x0040acf7
0x0040ace9
0x0040acd3
0x0040ae52
0x0040ae5b

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,004163D0,?,?), ref: 0040ACB9
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040ACCA
FindFirstFileW.KERNEL32(?,?,kernel32.dll,004163D0,?,?), ref: 0040ADCA
FindClose.KERNEL32(?,?,?,kernel32.dll,004163D0,?,?), ref: 0040ADDC
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,004163D0,?,?), ref: 0040ADE8
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,004163D0,?,?), ref: 0040AE2D

Strings

GetLongPathNameW, xrefs: 0040ACC4
\, xrefs: 0040ADFA
kernel32.dll, xrefs: 0040ACB4

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: c23059803d50ffbb69bc2ce4a2bd9c62d9d22e9847f338aa71202613e6372609
Instruction ID: 41d01645e24d257238dd5067bd4c9414aa615acd03712fd1fd4c25b28ebdd489
Opcode Fuzzy Hash: c23059803d50ffbb69bc2ce4a2bd9c62d9d22e9847f338aa71202613e6372609
Instruction Fuzzy Hash: 7941A331A007189BCB10EFA4CC85ADEB3B5AF44310F1885B69544F73D1E7799E518B8A

Uniqueness

Uniqueness Score: -1.00%

Function 004A0E28, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004A0E28() {
				int _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				int _t7;

				if(E0042004C() != 2) {
					L5:
					_t7 = ExitWindowsEx(2, 0);
					asm("sbb eax, eax");
					return _t7 + 1;
				}
				if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) != 0) {
					LookupPrivilegeValueW(0, L"SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					if(GetLastError() == 0) {
						goto L5;
					}
					return 0;
				}
				return 0;
			}

0x004a0e33
0x004a0e90
0x004a0e94
0x004a0e9c
0x00000000
0x004a0e9e
0x004a0e45
0x004a0e57
0x004a0e5c
0x004a0e64
0x004a0e7e
0x004a0e8a
0x00000000
0x00000000
0x00000000
0x004a0e8c
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004A0E38
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004A0E3E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004A0E57
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 004A0E7E
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004A0E83
ExitWindowsEx.USER32(00000002,00000000), ref: 004A0E94

Strings

SeShutdownPrivilege, xrefs: 004A0E50

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: fe1b067eca73296cefec74aef68d5e38e82838797bed51e4050b4c645f3bddb9
Instruction ID: de75dd4a19c05497f4e369505de79ffe978a6723dd01d742fb3c8f7576f479cb
Opcode Fuzzy Hash: fe1b067eca73296cefec74aef68d5e38e82838797bed51e4050b4c645f3bddb9
Instruction Fuzzy Hash: 8AF06D7068430179F720A6B28C07F2B61C89B56B48F900C2AFA85EA1C2E7BDD414526F

Uniqueness

Uniqueness Score: -1.00%

Function 004A1700, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004A1700() {
				struct HRSRC__* _t10;
				void* _t11;
				void* _t12;

				_t10 = FindResourceW(0, 0x2b67, 0xa);
				if(_t10 == 0) {
					E004A1544();
				}
				if(SizeofResource(0, _t10) != 0x2c) {
					E004A1544();
				}
				_t11 = LoadResource(0, _t10);
				if(_t11 == 0) {
					E004A1544();
				}
				_t12 = LockResource(_t11);
				if(_t12 == 0) {
					E004A1544();
				}
				return _t12;
			}

0x004a170f
0x004a1713
0x004a1715
0x004a1715
0x004a1725
0x004a1727
0x004a1727
0x004a1734
0x004a1738
0x004a173a
0x004a173a
0x004a1745
0x004a1749
0x004a174b
0x004a174b
0x004a1753

APIs

FindResourceW.KERNEL32(00000000,00002B67,0000000A,?,004A7F72,00000000,004A852A,?,00000001,00000000,00000002,00000000,004A857E,?,00000000,004A85C2), ref: 004A170A
SizeofResource.KERNEL32(00000000,00000000,00000000,00002B67,0000000A,?,004A7F72,00000000,004A852A,?,00000001,00000000,00000002,00000000,004A857E), ref: 004A171D
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00002B67,0000000A,?,004A7F72,00000000,004A852A,?,00000001,00000000,00000002,00000000), ref: 004A172F
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00002B67,0000000A,?,004A7F72,00000000,004A852A,?,00000001,00000000,00000002), ref: 004A1740

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 0e167eaf222881e49b93fd61e2515b39df1dd1f3b826912796eb5bb1c6379618
Instruction ID: d09968d54a12af4fb9a7ffdc410a445be0be65e0f1a53bf5b11a7e4f68c05b11
Opcode Fuzzy Hash: 0e167eaf222881e49b93fd61e2515b39df1dd1f3b826912796eb5bb1c6379618
Instruction Fuzzy Hash: 2AE09284B8575635FA643AF71CC7B6E00094B7778DF40183BF606692E2EDACCC14122E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A840, Relevance: 4.6, APIs: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0040A840(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				short _v182;
				short _v352;
				char _v356;
				char _v360;
				char _v364;
				int _t58;
				signed int _t61;
				intOrPtr _t70;
				signed short _t80;
				void* _t83;
				void* _t85;
				void* _t86;

				_t77 = __edi;
				_push(__edi);
				_v356 = 0;
				_v360 = 0;
				_v364 = 0;
				_v8 = __edx;
				_t80 = __eax;
				_push(_t83);
				_push(0x40a9a5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83 + 0xfffffe98;
				E004079F4(_v8);
				_t85 = _t80 -  *0x4a9a08; // 0x404
				if(_t85 >= 0) {
					_t86 = _t80 -  *0x4a9c08; // 0x7c68
					if(_t86 <= 0) {
						_t77 = 0x40;
						_v12 = 0;
						if(0x40 >= _v12) {
							do {
								_t61 = _t77 + _v12 >> 1;
								if(_t80 >=  *((intOrPtr*)(0x4a9a08 + _t61 * 8))) {
									__eflags = _t80 -  *((intOrPtr*)(0x4a9a08 + _t61 * 8));
									if(__eflags <= 0) {
										E0040A760( *((intOrPtr*)(0x4a9a0c + _t61 * 8)), _t61, _v8, _t77, _t80, __eflags);
									} else {
										_v12 = _t61 + 1;
										goto L8;
									}
								} else {
									_t77 = _t61 - 1;
									goto L8;
								}
								goto L9;
								L8:
							} while (_t77 >= _v12);
						}
					}
				}
				L9:
				if( *_v8 == 0 && IsValidLocale(_t80 & 0x0000ffff, 2) != 0) {
					_t58 = _t80 & 0x0000ffff;
					GetLocaleInfoW(_t58, 0x59,  &_v182, 0x55);
					GetLocaleInfoW(_t58, 0x5a,  &_v352, 0x55);
					E0040856C( &_v356, 0x55,  &_v182);
					_push(_v356);
					_push(0x40a9c0);
					E0040856C( &_v360, 0x55,  &_v352);
					_push(_v360);
					_push(E0040A9D0);
					E0040856C( &_v364, 0x55,  &_v182);
					_push(_v364);
					E004087A4(_v8, _t58, 5, _t77, _t80);
				}
				_pop(_t70);
				 *[fs:eax] = _t70;
				_push(E0040A9AC);
				return E00407A54( &_v364, 3);
			}

0x0040a840
0x0040a84b
0x0040a84e
0x0040a854
0x0040a85a
0x0040a860
0x0040a863
0x0040a867
0x0040a868
0x0040a86d
0x0040a870
0x0040a876
0x0040a87b
0x0040a882
0x0040a884
0x0040a88b
0x0040a88d
0x0040a894
0x0040a89a
0x0040a89c
0x0040a8a1
0x0040a8ab
0x0040a8b2
0x0040a8ba
0x0040a8cc
0x0040a8bc
0x0040a8bd
0x00000000
0x0040a8bd
0x0040a8ad
0x0040a8af
0x00000000
0x0040a8af
0x00000000
0x0040a8d3
0x0040a8d3
0x0040a89c
0x0040a89a
0x0040a88b
0x0040a8d8
0x0040a8de
0x0040a902
0x0040a906
0x0040a917
0x0040a92d
0x0040a932
0x0040a938
0x0040a94e
0x0040a953
0x0040a959
0x0040a96f
0x0040a974
0x0040a982
0x0040a982
0x0040a989
0x0040a98c
0x0040a98f
0x0040a9a4

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040A9A5,?,004163D0,?,00000000), ref: 0040A8EA
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040A9A5,?,004163D0,?,00000000), ref: 0040A906
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040A9A5,?,004163D0,?,00000000), ref: 0040A917

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 64b235b34ad3b405be668a38bbcf0c4c9e16d70e7dca781f39a661cc6ac02bf3
Instruction ID: a21452d7453331bea184a1c788462f810345500a03990f2c05a1053d145e59cd
Opcode Fuzzy Hash: 64b235b34ad3b405be668a38bbcf0c4c9e16d70e7dca781f39a661cc6ac02bf3
Instruction Fuzzy Hash: 53319EB1A00708AAEB20EB55CC81BEF7BB9EB45701F1044BBA104B72D0D7395E91DF1A

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5FC, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A5FC(WCHAR* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				WCHAR* _t25;
				int _t26;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr _t46;
				intOrPtr _t48;

				_t25 = _a4;
				if(_t25 == 0) {
					_t25 = 0;
				}
				_t26 = GetDiskFreeSpaceW(_t25,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t46 = _v24;
				_t31 = E004098FC(_v28, _t46, _v16, 0);
				_t37 = _a8;
				 *_t37 = _t31;
				 *((intOrPtr*)(_t37 + 4)) = _t46;
				_t48 = _v24;
				_t34 = E004098FC(_v28, _t48, _v20, 0);
				_t38 = _a12;
				 *_t38 = _t34;
				 *((intOrPtr*)(_t38 + 4)) = _t48;
				return _t26;
			}

0x0041a603
0x0041a608
0x0041a60a
0x0041a60a
0x0041a61d
0x0041a62c
0x0041a62f
0x0041a63c
0x0041a63f
0x0041a644
0x0041a647
0x0041a649
0x0041a656
0x0041a659
0x0041a65e
0x0041a661
0x0041a663
0x0041a66c

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0041A61D

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 1f81ffd3f8b7f43dd4d40be7e4fa3e48113c3a6555be2f83e13846e6c896b012
Instruction ID: 1ffc0297bdb4ea11008dc3bcb63dba6813c0f317fc4836b7b6f34cb81ab2f15a
Opcode Fuzzy Hash: 1f81ffd3f8b7f43dd4d40be7e4fa3e48113c3a6555be2f83e13846e6c896b012
Instruction Fuzzy Hash: 4B110CB5E00209AFDB00DF99C8819AFB7F9EFC8304B14C56AA508E7255E6319E018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041E154, Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041E154(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				short _v516;
				void* __ebp;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoW(__eax, __edx,  &_v516, 0x100);
				_t19 = _t5;
				if(_t5 <= 0) {
					return E00407DD4(_t10, _t18);
				}
				return E00407B7C(_t10, _t5 - 1,  &_v516, _t19);
			}

0x0041e15f
0x0041e161
0x0041e172
0x0041e177
0x0041e179
0x00000000
0x0041e191
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041E172

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7928e8acb0f3bf95a95806c5ee37cf780a020151f3d59b515ba1fff5897a5f5c
Instruction ID: 7cf265298f8ae4c2c4586e2e1eef3c96f0d827603146793af8923f5675885b80
Opcode Fuzzy Hash: 7928e8acb0f3bf95a95806c5ee37cf780a020151f3d59b515ba1fff5897a5f5c
Instruction Fuzzy Hash: 73E09235B0421427E314A55A8C86EFA725C9B48340F40457FBE05D7382ED74AD4082E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1A0, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0041E1A0(int __eax, signed int __ecx, int __edx) {
				short _v16;
				signed int _t5;
				signed int _t10;

				_push(__ecx);
				_t10 = __ecx;
				if(GetLocaleInfoW(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t10;
				} else {
					_t5 = _v16 & 0x0000ffff;
				}
				return _t5;
			}

0x0041e1a3
0x0041e1a4
0x0041e1ba
0x0041e1c2
0x0041e1bc
0x0041e1bc
0x0041e1bc
0x0041e1c8

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,0041E2A2,?,00000001,00000000,0041E4B1), ref: 0041E1B3

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 43bf76aed24dc9c521354dcf3a82bfc67647264a5ffb14c8d3d6dbd711227945
Instruction ID: c7815ca7096205c7b25e67d21c63a0a54a6ca7704bde0e99258243124e7cf7fc
Opcode Fuzzy Hash: 43bf76aed24dc9c521354dcf3a82bfc67647264a5ffb14c8d3d6dbd711227945
Instruction Fuzzy Hash: 8AD05EBA30922036E214915B6D45DBB56DCCBC97A2F144C3BBE48C7241D224CC46D275

Uniqueness

Uniqueness Score: -1.00%

Function 004A0F30, Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004A0F30(signed int __eax) {
				short _v8;
				signed int _t6;

				_t6 = GetLocaleInfoW(__eax & 0x0000ffff, 0x20001004,  &_v8, 2);
				if(_t6 <= 0) {
					return _t6 | 0xffffffff;
				}
				return _v8;
			}

0x004a0f46
0x004a0f4d
0x00000000
0x004a0f54
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,004A1030), ref: 004A0F46

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c33d9d24f17edf913d3c59cc52c7a948e32ac160c74623fd23b254e084f3a8be
Instruction ID: a387aee5510ce7cb312478dcb7dda2bca2cadc0d391de8f1265bd776c9a03677
Opcode Fuzzy Hash: c33d9d24f17edf913d3c59cc52c7a948e32ac160c74623fd23b254e084f3a8be
Instruction Fuzzy Hash: 2CD05B61504308BDF504C1965D82D76729C9709324F500616F618D51C1D6A5FE005228

Uniqueness

Uniqueness Score: -1.00%

Function 0041C4F8, Relevance: 1.5, APIs: 1, Instructions: 6
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041C4F8() {
				struct _SYSTEMTIME* _t2;

				GetLocalTime(_t2);
				return _t2->wYear & 0x0000ffff;
			}

0x0041c4fc
0x0041c508

APIs

GetLocalTime.KERNEL32 ref: 0041C4FC

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 432e8ebe5e08171c98f20f808d41c161dd1ffcd0287293d7c08b14c61d049f45
Instruction ID: 30d254df6966928add27f6c53b79b67b7018594c25d8f6651389e5cc9869a0f0
Opcode Fuzzy Hash: 432e8ebe5e08171c98f20f808d41c161dd1ffcd0287293d7c08b14c61d049f45
Instruction Fuzzy Hash: 90A0120040582001D140331A0C0313930405800624FC40F55BCF8502D5E92D013440D7

Uniqueness

Uniqueness Score: -1.00%

Function 004A8660, Relevance: 1.4, Instructions: 1444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710065fafc2dfdda063c0859aa4b65bfb060e8819a06dbba5771bc72c3c1f0dc
Instruction ID: 5b71c1ebb547df7d243d3199aaf6b61bd939c7d327bd0ce4b7698c670e010e70
Opcode Fuzzy Hash: 710065fafc2dfdda063c0859aa4b65bfb060e8819a06dbba5771bc72c3c1f0dc
Instruction Fuzzy Hash: 91E14A6058E7D25FD707877848685997FB0AE5312531F86EBC4C5CF8A3C29D8C4AC36A

Uniqueness

Uniqueness Score: -1.00%

Function 004254D0, Relevance: .5, Instructions: 545
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004254D0(intOrPtr* __eax, intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				char _v25;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				char _v64;
				char* _v68;
				void* _v72;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				char _v89;
				char _v96;
				signed int _v100;
				signed int _v104;
				short* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				char _v136;
				signed int _t370;
				void* _t375;
				signed int _t377;
				signed int _t381;
				signed int _t389;
				signed int _t395;
				signed int _t411;
				intOrPtr _t422;
				signed int _t426;
				signed int _t435;
				void* _t448;
				signed int _t458;
				char _t460;
				signed int _t474;
				char* _t503;
				signed int _t508;
				signed int _t616;
				signed int _t617;
				signed int _t618;
				signed int _t622;

				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v20 =  *((intOrPtr*)(_v8 + 0x10));
				_v24 = 0;
				_v32 = (1 <<  *(_v8 + 8)) - 1;
				_v36 = (1 <<  *(_v8 + 4)) - 1;
				_v40 =  *_v8;
				_t617 =  *((intOrPtr*)(_v8 + 0x34));
				_t474 =  *(_v8 + 0x44);
				_v44 =  *((intOrPtr*)(_v8 + 0x38));
				_v48 =  *((intOrPtr*)(_v8 + 0x3c));
				_v52 =  *((intOrPtr*)(_v8 + 0x40));
				_v56 =  *((intOrPtr*)(_v8 + 0x48));
				_v60 =  *((intOrPtr*)(_v8 + 0x2c));
				_v64 =  *((intOrPtr*)(_v8 + 0x30));
				_v68 =  *((intOrPtr*)(_v8 + 0x1c));
				_v72 =  *((intOrPtr*)(_v8 + 0xc));
				_t616 =  *((intOrPtr*)(_v8 + 0x28));
				_v128 =  *((intOrPtr*)(_v8 + 0x20));
				_v124 =  *((intOrPtr*)(_v8 + 0x24));
				_v120 = _v12;
				_v136 =  *((intOrPtr*)(_v8 + 0x14));
				_v132 =  *((intOrPtr*)(_v8 + 0x18));
				 *_a4 = 0;
				if(_v56 == 0xffffffff) {
					return 0;
				}
				__eflags = _v72;
				if(_v72 == 0) {
					_v68 =  &_v76;
					_v72 = 1;
					_v76 =  *((intOrPtr*)(_v8 + 0x4c));
				}
				__eflags = _v56 - 0xfffffffe;
				if(_v56 != 0xfffffffe) {
					L12:
					_v108 = _v16 + _v24;
					while(1) {
						__eflags = _v56;
						if(_v56 == 0) {
							break;
						}
						__eflags = _v24 - _a8;
						if(_v24 < _a8) {
							_t458 = _t616 - _t617;
							__eflags = _t458 - _v72;
							if(_t458 >= _v72) {
								_t458 = _t458 + _v72;
								__eflags = _t458;
							}
							_t460 =  *((intOrPtr*)(_v68 + _t458));
							 *((char*)(_v68 + _t616)) = _t460;
							 *_v108 = _t460;
							_v24 = _v24 + 1;
							_v108 = _v108 + 1;
							_t616 = _t616 + 1;
							__eflags = _t616 - _v72;
							if(_t616 == _v72) {
								_t616 = 0;
								__eflags = 0;
							}
							_t116 =  &_v56;
							 *_t116 = _v56 - 1;
							__eflags =  *_t116;
							continue;
						}
						break;
					}
					__eflags = _t616;
					if(_t616 != 0) {
						_v25 =  *((intOrPtr*)(_v68 + _t616 - 1));
					} else {
						_v25 =  *((intOrPtr*)(_v68 + _v72 - 1));
					}
					__eflags = 0;
					_v116 = 0;
					_v112 = 0;
					while(1) {
						L24:
						_v108 = _v16 + _v24;
						__eflags = _v24 - _a8;
						if(_v24 >= _a8) {
							break;
						} else {
							goto L25;
						}
						while(1) {
							L25:
							_v88 = _v24 + _v60 & _v32;
							__eflags = _v116;
							if(_v116 != 0) {
								break;
							}
							__eflags = _v112;
							if(_v112 == 0) {
								_t370 = E00425228((_t474 << 4) + (_t474 << 4) + _v20 + _v88 + _v88,  &_v136);
								__eflags = _t370;
								if(_t370 != 0) {
									_t375 = E00425228(_t474 + _t474 + _v20 + 0x180,  &_v136);
									__eflags = _t375 != 1;
									if(_t375 != 1) {
										_v52 = _v48;
										_v48 = _v44;
										_v44 = _t617;
										__eflags = _t474 - 7;
										if(__eflags >= 0) {
											_t377 = 0xa;
										} else {
											_t377 = 7;
										}
										_t474 = _t377;
										_v56 = E004253D8(_v20 + 0x664, _v88,  &_v136, __eflags);
										_t503 =  &_v136;
										__eflags = _v56 - 4;
										if(_v56 >= 4) {
											_t381 = 3;
										} else {
											_t381 = _v56;
										}
										_v100 = E004252B0((_t381 << 6) + (_t381 << 6) + _v20 + 0x360, _t503, 6);
										__eflags = _v100 - 4;
										if(_v100 < 4) {
											_t618 = _v100;
										} else {
											_v104 = (_v100 >> 1) - 1;
											_t524 = _v104;
											_t622 = (_v100 & 0x00000001 | 0x00000002) << _v104;
											__eflags = _v100 - 0xe;
											if(_v100 >= 0xe) {
												_t395 = E004251C8( &_v136, _t524, _v104 + 0xfffffffc);
												_t618 = _t622 + (_t395 << 4) + E004252F4(_v20 + 0x644,  &_v136, 4);
											} else {
												_t618 = _t622 + E004252F4(_t622 + _t622 + _v20 + 0x560 - _v100 + _v100 + 0xfffffffe,  &_v136, _v104);
											}
										}
										_t617 = _t618 + 1;
										__eflags = _t617;
										if(_t617 != 0) {
											L82:
											_v56 = _v56 + 2;
											__eflags = _t617 - _v64;
											if(_t617 <= _v64) {
												__eflags = _v72 - _v64 - _v56;
												if(_v72 - _v64 <= _v56) {
													_v64 = _v72;
												} else {
													_v64 = _v64 + _v56;
												}
												while(1) {
													_t389 = _t616 - _t617;
													__eflags = _t389 - _v72;
													if(_t389 >= _v72) {
														_t389 = _t389 + _v72;
														__eflags = _t389;
													}
													_v25 =  *((intOrPtr*)(_v68 + _t389));
													 *((char*)(_v68 + _t616)) = _v25;
													_t616 = _t616 + 1;
													__eflags = _t616 - _v72;
													if(_t616 == _v72) {
														_t616 = 0;
														__eflags = 0;
													}
													_v56 = _v56 - 1;
													 *_v108 = _v25;
													_v24 = _v24 + 1;
													_v108 = _v108 + 1;
													__eflags = _v56;
													if(_v56 == 0) {
														break;
													}
													__eflags = _v24 - _a8;
													if(_v24 < _a8) {
														continue;
													}
													break;
												}
												L93:
												__eflags = _v24 - _a8;
												if(_v24 < _a8) {
													continue;
												}
												goto L94;
											}
											return 1;
										} else {
											_v56 = 0xffffffff;
											goto L94;
										}
									}
									_t411 = E00425228(_t474 + _t474 + _v20 + 0x198,  &_v136);
									__eflags = _t411;
									if(_t411 != 0) {
										__eflags = E00425228(_t474 + _t474 + _v20 + 0x1b0,  &_v136);
										if(__eflags != 0) {
											__eflags = E00425228(_t474 + _t474 + _v20 + 0x1c8,  &_v136);
											if(__eflags != 0) {
												_t422 = _v52;
												_v52 = _v48;
											} else {
												_t422 = _v48;
											}
											_v48 = _v44;
										} else {
											_t422 = _v44;
										}
										_v44 = _t617;
										_t617 = _t422;
										L65:
										_v56 = E004253D8(_v20 + 0xa68, _v88,  &_v136, __eflags);
										__eflags = _t474 - 7;
										if(_t474 >= 7) {
											_t426 = 0xb;
										} else {
											_t426 = 8;
										}
										_t474 = _t426;
										goto L82;
									}
									__eflags = E00425228((_t474 << 4) + (_t474 << 4) + _v20 + _v88 + _v88 + 0x1e0,  &_v136);
									if(__eflags != 0) {
										goto L65;
									}
									__eflags = _v64;
									if(_v64 != 0) {
										__eflags = _t474 - 7;
										if(_t474 >= 7) {
											_t508 = 0xb;
										} else {
											_t508 = 9;
										}
										_t474 = _t508;
										_t435 = _t616 - _t617;
										__eflags = _t435 - _v72;
										if(_t435 >= _v72) {
											_t435 = _t435 + _v72;
											__eflags = _t435;
										}
										_v25 =  *((intOrPtr*)(_v68 + _t435));
										 *((char*)(_v68 + _t616)) = _v25;
										_t616 = _t616 + 1;
										__eflags = _t616 - _v72;
										if(_t616 == _v72) {
											_t616 = 0;
											__eflags = 0;
										}
										 *_v108 = _v25;
										_v24 = _v24 + 1;
										__eflags = _v64 - _v72;
										if(_v64 < _v72) {
											_v64 = _v64 + 1;
										}
										goto L24;
									}
									return 1;
								}
								_t448 = (((_v24 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) + (((_v24 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) * 2 + (((_v24 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) + (((_v24 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) * 2 + _v20 + 0xe6c;
								__eflags = _t474 - 7;
								if(__eflags < 0) {
									_v25 = E00425338(_t448,  &_v136, __eflags);
								} else {
									_v96 = _t616 - _t617;
									__eflags = _v96 - _v72;
									if(__eflags >= 0) {
										_t161 =  &_v96;
										 *_t161 = _v96 + _v72;
										__eflags =  *_t161;
									}
									_v89 =  *((intOrPtr*)(_v68 + _v96));
									_v25 = E00425364(_t448, _v89,  &_v136, __eflags);
								}
								 *_v108 = _v25;
								_v24 = _v24 + 1;
								_v108 = _v108 + 1;
								__eflags = _v64 - _v72;
								if(_v64 < _v72) {
									_t180 =  &_v64;
									 *_t180 = _v64 + 1;
									__eflags =  *_t180;
								}
								 *((char*)(_v68 + _t616)) = _v25;
								_t616 = _t616 + 1;
								__eflags = _t616 - _v72;
								if(_t616 == _v72) {
									_t616 = 0;
									__eflags = 0;
								}
								__eflags = _t474 - 4;
								if(_t474 >= 4) {
									__eflags = _t474 - 0xa;
									if(_t474 >= 0xa) {
										_t474 = _t474 - 6;
									} else {
										_t474 = _t474 - 3;
									}
								} else {
									_t474 = 0;
								}
								goto L93;
							}
							return 1;
						}
						return _v116;
					}
					L94:
					 *((intOrPtr*)(_v8 + 0x20)) = _v128;
					 *((intOrPtr*)(_v8 + 0x24)) = _v124;
					 *((intOrPtr*)(_v8 + 0x28)) = _t616;
					 *((intOrPtr*)(_v8 + 0x2c)) = _v60 + _v24;
					 *((intOrPtr*)(_v8 + 0x30)) = _v64;
					 *((intOrPtr*)(_v8 + 0x34)) = _t617;
					 *((intOrPtr*)(_v8 + 0x38)) = _v44;
					 *((intOrPtr*)(_v8 + 0x3c)) = _v48;
					 *((intOrPtr*)(_v8 + 0x40)) = _v52;
					 *(_v8 + 0x44) = _t474;
					 *((intOrPtr*)(_v8 + 0x48)) = _v56;
					 *((char*)(_v8 + 0x4c)) = _v76;
					 *((intOrPtr*)(_v8 + 0x14)) = _v136;
					 *((intOrPtr*)(_v8 + 0x18)) = _v132;
					 *_a4 = _v24;
					__eflags = 0;
					return 0;
				}
				_v80 = (0x300 <<  *(_v8 + 4) + _v40) + 0x736;
				_v84 = 0;
				_v108 = _v20;
				__eflags = _v84 - _v80;
				if(_v84 >= _v80) {
					L7:
					_v52 = 1;
					_v48 = 1;
					_v44 = 1;
					_t617 = 1;
					_v60 = 0;
					_v64 = 0;
					_t474 = 0;
					_t616 = 0;
					 *((char*)(_v68 + _v72 - 1)) = 0;
					E00425188( &_v136);
					__eflags = _v116;
					if(_v116 != 0) {
						return _v116;
					}
					__eflags = _v112;
					if(_v112 == 0) {
						__eflags = 0;
						_v56 = 0;
						goto L12;
					} else {
						return 1;
					}
				} else {
					goto L6;
				}
				do {
					L6:
					 *_v108 = 0x400;
					_v84 = _v84 + 1;
					_v108 = _v108 + 2;
					__eflags = _v84 - _v80;
				} while (_v84 < _v80);
				goto L7;
			}

0x004254dc
0x004254df
0x004254e2
0x004254ed
0x004254f0
0x00425501
0x00425512
0x0042551a
0x00425523
0x00425529
0x0042552f
0x00425538
0x00425541
0x0042554a
0x00425553
0x0042555c
0x00425565
0x0042556e
0x00425577
0x0042557d
0x00425586
0x0042558c
0x00425595
0x004255a3
0x004255a9
0x004255af
0x00000000
0x004255b1
0x004255b8
0x004255bc
0x004255c1
0x004255c4
0x004255d1
0x004255d1
0x004255d4
0x004255d8
0x00425679
0x00425682
0x004256b7
0x004256b7
0x004256bb
0x00000000
0x00000000
0x004256c0
0x004256c3
0x00425689
0x0042568b
0x0042568e
0x00425690
0x00425690
0x00425690
0x0042569d
0x0042569e
0x004256a4
0x004256a6
0x004256a9
0x004256ac
0x004256ad
0x004256b0
0x004256b2
0x004256b2
0x004256b2
0x004256b4
0x004256b4
0x004256b4
0x00000000
0x004256b4
0x00000000
0x004256c3
0x004256c5
0x004256c7
0x004256df
0x004256c9
0x004256d3
0x004256d3
0x004256e4
0x004256e6
0x004256e9
0x004256ec
0x004256ec
0x004256f5
0x004256fb
0x004256fe
0x00000000
0x00000000
0x00000000
0x00000000
0x00425704
0x00425704
0x0042570d
0x00425710
0x00425714
0x00000000
0x00000000
0x0042571e
0x00425722
0x00425745
0x0042574a
0x0042574c
0x00425825
0x0042582a
0x0042582b
0x0042596b
0x00425971
0x00425974
0x00425977
0x0042597a
0x00425983
0x0042597c
0x0042597c
0x0042597c
0x00425988
0x004259a0
0x004259a3
0x004259a9
0x004259ad
0x004259b4
0x004259af
0x004259af
0x004259af
0x004259d0
0x004259d3
0x004259d7
0x00425a50
0x004259d9
0x004259df
0x004259e2
0x004259ee
0x004259f0
0x004259f4
0x00425a2a
0x00425a4c
0x004259f6
0x00425a1a
0x00425a1a
0x004259f4
0x00425a53
0x00425a53
0x00425a54
0x00425a5f
0x00425a5f
0x00425a63
0x00425a66
0x00425a78
0x00425a7b
0x00425a88
0x00425a7d
0x00425a80
0x00425a80
0x00425a8b
0x00425a8d
0x00425a8f
0x00425a92
0x00425a94
0x00425a94
0x00425a94
0x00425a9d
0x00425aa6
0x00425aa9
0x00425aaa
0x00425aad
0x00425aaf
0x00425aaf
0x00425aaf
0x00425ab1
0x00425aba
0x00425abc
0x00425abf
0x00425ac2
0x00425ac6
0x00000000
0x00000000
0x00425acb
0x00425ace
0x00000000
0x00000000
0x00000000
0x00425ace
0x00425ad0
0x00425ad3
0x00425ad6
0x00000000
0x00000000
0x00000000
0x00425ad6
0x00000000
0x00425a56
0x00425a56
0x00000000
0x00425a56
0x00425a54
0x00425843
0x00425848
0x0042584a
0x004258fa
0x004258fc
0x0042591a
0x0042591c
0x00425923
0x00425929
0x0042591e
0x0042591e
0x0042591e
0x0042592f
0x004258fe
0x004258fe
0x004258fe
0x00425932
0x00425935
0x00425937
0x0042594d
0x00425950
0x00425953
0x0042595c
0x00425955
0x00425955
0x00425955
0x00425961
0x00000000
0x00425961
0x00425871
0x00425873
0x00000000
0x00000000
0x00425879
0x0042587d
0x00425889
0x0042588c
0x00425895
0x0042588e
0x0042588e
0x0042588e
0x0042589a
0x0042589e
0x004258a0
0x004258a3
0x004258a5
0x004258a5
0x004258a5
0x004258ae
0x004258b7
0x004258ba
0x004258bb
0x004258be
0x004258c0
0x004258c0
0x004258c0
0x004258c8
0x004258ca
0x004258d0
0x004258d3
0x004258d9
0x004258d9
0x00000000
0x004258d3
0x00000000
0x0042587f
0x0042577c
0x00425781
0x00425784
0x004257c5
0x00425786
0x0042578a
0x00425790
0x00425793
0x00425798
0x00425798
0x00425798
0x00425798
0x004257a4
0x004257b5
0x004257b5
0x004257ce
0x004257d0
0x004257d3
0x004257d9
0x004257dc
0x004257de
0x004257de
0x004257de
0x004257de
0x004257e7
0x004257ea
0x004257eb
0x004257ee
0x004257f0
0x004257f0
0x004257f0
0x004257f2
0x004257f5
0x004257fe
0x00425801
0x0042580b
0x00425803
0x00425803
0x00425803
0x004257f7
0x004257f7
0x004257f7
0x00000000
0x004257f5
0x00000000
0x00425724
0x00000000
0x00425716
0x00425adc
0x00425ae2
0x00425aeb
0x00425af1
0x00425afd
0x00425b06
0x00425b0c
0x00425b15
0x00425b1e
0x00425b27
0x00425b2d
0x00425b36
0x00425b3f
0x00425b4b
0x00425b54
0x00425b5d
0x00425b5f
0x00000000
0x00425b5f
0x004255f5
0x004255f8
0x00425600
0x00425606
0x00425609
0x00425622
0x00425629
0x0042562c
0x0042562f
0x00425632
0x00425634
0x00425639
0x0042563c
0x00425644
0x00425646
0x00425651
0x00425656
0x0042565a
0x00000000
0x0042565c
0x00425664
0x00425668
0x00425674
0x00425676
0x00000000
0x0042566a
0x00000000
0x0042566a
0x00000000
0x00000000
0x00000000
0x0042560b
0x0042560b
0x0042560e
0x00425613
0x00425616
0x0042561d
0x0042561d
0x00000000

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 714bfb58b2794d167d20b22a4996e34f8aecc2b55e378ed3f9398e5555f8a7d3
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 0D320374E00629DFCB04CF98D981AADBBB2BF88314F64816AD805AB341D774AE42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00431F50, Relevance: .4, Instructions: 408
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00431F50(signed int* __eax, intOrPtr __ecx, signed int __edx) {
				signed int* _v8;
				signed int* _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				unsigned int* _t96;
				unsigned int* _t106;
				signed int* _t108;
				signed int _t109;

				_t109 = __edx;
				_v16 = __ecx;
				_v12 = __eax;
				_t106 =  &_v24;
				_t108 =  &_v28;
				_t96 =  &_v20;
				 *_t96 = __edx + 0xdeadbeef + _v16;
				 *_t106 =  *_t96;
				 *_t108 =  *_t96;
				_v8 = _v12;
				if((_v8 & 0x00000003) != 0) {
					if(__edx <= 0xc) {
						L20:
						if(_t109 > 0xc) {
							L23:
							 *_t108 =  *_t108 + ((_v8[2] & 0x000000ff) << 0x18);
							L24:
							 *_t108 =  *_t108 + ((_v8[2] & 0x000000ff) << 0x10);
							L25:
							 *_t108 =  *_t108 + ((_v8[2] & 0x000000ff) << 8);
							L26:
							 *_t108 =  *_t108 + (_v8[2] & 0x000000ff);
							L27:
							 *_t106 =  *_t106 + ((_v8[1] & 0x000000ff) << 0x18);
							L28:
							 *_t106 =  *_t106 + ((_v8[1] & 0x000000ff) << 0x10);
							L29:
							 *_t106 =  *_t106 + ((_v8[1] & 0x000000ff) << 8);
							L30:
							 *_t106 =  *_t106 + (_v8[1] & 0x000000ff);
							L31:
							 *_t96 =  *_t96 + ((_v8[0] & 0x000000ff) << 0x18);
							L32:
							 *_t96 =  *_t96 + ((_v8[0] & 0x000000ff) << 0x10);
							L33:
							 *_t96 =  *_t96 + ((_v8[0] & 0x000000ff) << 8);
							L34:
							 *_t96 =  *_t96 + ( *_v8 & 0x000000ff);
							L35:
							 *_t108 =  *_t108 ^  *_t106;
							 *_t108 =  *_t108 - ( *_t106 << 0x0000000e |  *_t106 >> 0x00000012);
							 *_t96 =  *_t96 ^  *_t108;
							 *_t96 =  *_t96 - ( *_t108 << 0x0000000b |  *_t108 >> 0x00000015);
							 *_t106 =  *_t106 ^  *_t96;
							 *_t106 =  *_t106 - ( *_t96 << 0x00000019 |  *_t96 >> 0x00000007);
							 *_t108 =  *_t108 ^  *_t106;
							 *_t108 =  *_t108 - ( *_t106 << 0x00000010 |  *_t106 >> 0x00000010);
							 *_t96 =  *_t96 ^  *_t108;
							 *_t96 =  *_t96 - ( *_t108 << 0x00000004 |  *_t108 >> 0x0000001c);
							 *_t106 =  *_t106 ^  *_t96;
							 *_t106 =  *_t106 - ( *_t96 << 0x0000000e |  *_t96 >> 0x00000012);
							 *_t108 =  *_t108 ^  *_t106;
							 *_t108 =  *_t108 - ( *_t106 << 0x00000018 |  *_t106 >> 0x00000008);
							return  *_t108;
						}
						switch( *((intOrPtr*)(_t109 * 4 +  &M004322BD))) {
							case 0:
								return  *_t108;
							case 1:
								goto L34;
							case 2:
								goto L33;
							case 3:
								goto L32;
							case 4:
								goto L31;
							case 5:
								goto L30;
							case 6:
								goto L29;
							case 7:
								goto L28;
							case 8:
								goto L27;
							case 9:
								goto L26;
							case 0xa:
								goto L25;
							case 0xb:
								goto L24;
							case 0xc:
								goto L23;
						}
					} else {
						goto L19;
					}
					do {
						L19:
						 *_t96 =  *_t96 + ( *_v8 & 0x000000ff) + ((_v8[0] & 0x000000ff) << 8) + ((_v8[0] & 0x000000ff) << 0x10) + ((_v8[0] & 0x000000ff) << 0x18);
						 *_t106 =  *_t106 + (_v8[1] & 0x000000ff) + ((_v8[1] & 0x000000ff) << 8) + ((_v8[1] & 0x000000ff) << 0x10) + ((_v8[1] & 0x000000ff) << 0x18);
						 *_t108 =  *_t108 + (_v8[2] & 0x000000ff) + ((_v8[2] & 0x000000ff) << 8) + ((_v8[2] & 0x000000ff) << 0x10) + ((_v8[2] & 0x000000ff) << 0x18);
						 *_t96 =  *_t96 -  *_t108;
						 *_t96 =  *_t96 ^ ( *_t108 << 0x00000004 |  *_t108 >> 0x0000001c);
						 *_t108 =  *_t108 +  *_t106;
						 *_t106 =  *_t106 -  *_t96;
						 *_t106 =  *_t106 ^ ( *_t96 << 0x00000006 |  *_t96 >> 0x0000001a);
						 *_t96 =  *_t96 +  *_t108;
						 *_t108 =  *_t108 -  *_t106;
						 *_t108 =  *_t108 ^ ( *_t106 << 0x00000008 |  *_t106 >> 0x00000018);
						 *_t106 =  *_t106 +  *_t96;
						 *_t96 =  *_t96 -  *_t108;
						 *_t96 =  *_t96 ^ ( *_t108 << 0x00000010 |  *_t108 >> 0x00000010);
						 *_t108 =  *_t108 +  *_t106;
						 *_t106 =  *_t106 -  *_t96;
						 *_t106 =  *_t106 ^ ( *_t96 << 0x00000013 |  *_t96 >> 0x0000000d);
						 *_t96 =  *_t96 +  *_t108;
						 *_t108 =  *_t108 -  *_t106;
						 *_t108 =  *_t108 ^ ( *_t106 << 0x00000004 |  *_t106 >> 0x0000001c);
						 *_t106 =  *_t106 +  *_t96;
						_t109 = _t109 - 0xc;
						_v8 =  &(_v8[3]);
					} while (_t109 > 0xc);
					goto L20;
				}
				if(__edx <= 0xc) {
					L3:
					if(_t109 > 0xc) {
						goto L35;
					}
					switch( *((intOrPtr*)(_t109 * 4 +  &M00432051))) {
						case 0:
							return  *_t108;
						case 1:
							_v8 =  *_v8;
							__edx =  *_v8 & 0x000000ff;
							 *__eax =  *__eax + ( *_v8 & 0x000000ff);
							goto L35;
						case 2:
							_v8 =  *_v8;
							__edx =  *_v8 & 0x0000ffff;
							 *__eax =  *__eax + ( *_v8 & 0x0000ffff);
							goto L35;
						case 3:
							_v8 =  *_v8;
							__edx =  *_v8 & 0x00ffffff;
							 *__eax =  *__eax + ( *_v8 & 0x00ffffff);
							goto L35;
						case 4:
							_v8 =  *_v8;
							 *__eax =  *__eax +  *_v8;
							goto L35;
						case 5:
							__edx = _v8;
							 *__eax =  *__eax +  *__edx;
							__edx =  *(__edx + 4);
							 *__ebx =  *__ebx + __edx;
							goto L35;
						case 6:
							__edx = _v8;
							 *__eax =  *__eax +  *__edx;
							__edx =  *(__edx + 4);
							 *__ebx =  *__ebx + __edx;
							goto L35;
						case 7:
							__edx = _v8;
							 *__eax =  *__eax +  *__edx;
							__edx =  *(__edx + 4);
							 *__ebx =  *__ebx + __edx;
							goto L35;
						case 8:
							__edx = _v8;
							 *__eax =  *__eax +  *__edx;
							 *__ebx =  *__ebx + __edx;
							goto L35;
						case 9:
							__edx = _v8;
							 *__eax =  *__eax +  *__edx;
							 *__ebx =  *__ebx +  *(__edx + 4);
							__edx =  *(__edx + 8);
							 *__ecx =  *__ecx + __edx;
							goto L35;
						case 0xa:
							__edx = _v8;
							 *__eax =  *__eax +  *__edx;
							 *__ebx =  *__ebx +  *(__edx + 4);
							__edx =  *(__edx + 8);
							 *__ecx =  *__ecx + __edx;
							goto L35;
						case 0xb:
							__edx = _v8;
							 *__eax =  *__eax +  *__edx;
							 *__ebx =  *__ebx +  *(__edx + 4);
							__edx =  *(__edx + 8);
							 *__ecx =  *__ecx + __edx;
							goto L35;
						case 0xc:
							__edx = _v8;
							 *__eax =  *__eax +  *__edx;
							 *__ebx =  *__ebx +  *(__edx + 4);
							 *__ecx =  *__ecx + __edx;
							goto L35;
					}
				} else {
					goto L2;
				}
				do {
					L2:
					 *_t96 =  *_t96 +  *_v8;
					 *_t106 =  *_t106 + _v8[1];
					 *_t108 =  *_t108 + _v8[2];
					 *_t96 =  *_t96 -  *_t108;
					 *_t96 =  *_t96 ^ ( *_t108 << 0x00000004 |  *_t108 >> 0x0000001c);
					 *_t108 =  *_t108 +  *_t106;
					 *_t106 =  *_t106 -  *_t96;
					 *_t106 =  *_t106 ^ ( *_t96 << 0x00000006 |  *_t96 >> 0x0000001a);
					 *_t96 =  *_t96 +  *_t108;
					 *_t108 =  *_t108 -  *_t106;
					 *_t108 =  *_t108 ^ ( *_t106 << 0x00000008 |  *_t106 >> 0x00000018);
					 *_t106 =  *_t106 +  *_t96;
					 *_t96 =  *_t96 -  *_t108;
					 *_t96 =  *_t96 ^ ( *_t108 << 0x00000010 |  *_t108 >> 0x00000010);
					 *_t108 =  *_t108 +  *_t106;
					 *_t106 =  *_t106 -  *_t96;
					 *_t106 =  *_t106 ^ ( *_t96 << 0x00000013 |  *_t96 >> 0x0000000d);
					 *_t96 =  *_t96 +  *_t108;
					 *_t108 =  *_t108 -  *_t106;
					 *_t108 =  *_t108 ^ ( *_t106 << 0x00000004 |  *_t106 >> 0x0000001c);
					 *_t106 =  *_t106 +  *_t96;
					_t109 = _t109 - 0xc;
					_v8 = _v8 + 0xc;
				} while (_t109 > 0xc);
				goto L3;
			}

0x00431f50
0x00431f59
0x00431f5c
0x00431f5f
0x00431f62
0x00431f65
0x00431f73
0x00431f77
0x00431f7b
0x00431f80
0x00431f87
0x00432191
0x004322b1
0x004322b4
0x004322f8
0x00432302
0x00432304
0x0043230e
0x00432310
0x0043231a
0x0043231c
0x00432323
0x00432325
0x0043232f
0x00432331
0x0043233b
0x0043233d
0x00432347
0x00432349
0x00432350
0x00432352
0x0043235c
0x0043235e
0x00432368
0x0043236a
0x00432374
0x00432376
0x0043237c
0x0043237e
0x00432380
0x0043238e
0x00432392
0x004323a0
0x004323a4
0x004323b2
0x004323b6
0x004323c4
0x004323c8
0x004323d6
0x004323da
0x004323e8
0x004323ec
0x004323fa
0x00000000
0x004323fc
0x004322b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00432197
0x00432197
0x004321c1
0x004321ee
0x0043221b
0x0043221f
0x0043222d
0x00432231
0x00432235
0x00432243
0x00432247
0x0043224b
0x00432259
0x0043225d
0x00432261
0x0043226f
0x00432273
0x00432277
0x00432285
0x00432289
0x0043228d
0x0043229b
0x0043229f
0x004322a1
0x004322a4
0x004322a8
0x00000000
0x00432197
0x00431f90
0x00432041
0x00432044
0x00000000
0x00000000
0x0043204a
0x00000000
0x00000000
0x00000000
0x0043208f
0x00432091
0x00432097
0x00000000
0x00000000
0x004320a1
0x004320a3
0x004320a9
0x00000000
0x00000000
0x004320b3
0x004320b5
0x004320bb
0x00000000
0x00000000
0x004320c5
0x004320c7
0x00000000
0x00000000
0x004320ce
0x004320d3
0x004320d5
0x004320de
0x00000000
0x00000000
0x004320e5
0x004320ea
0x004320ec
0x004320f5
0x00000000
0x00000000
0x004320fc
0x00432101
0x00432103
0x0043210c
0x00000000
0x00000000
0x00432113
0x00432118
0x0043211d
0x00000000
0x00000000
0x00432124
0x00432129
0x0043212e
0x00432130
0x00432139
0x00000000
0x00000000
0x00432140
0x00432145
0x0043214a
0x0043214c
0x00432155
0x00000000
0x00000000
0x0043215c
0x00432161
0x00432166
0x00432168
0x00432171
0x00000000
0x00000000
0x00432178
0x0043217d
0x00432182
0x00432187
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00431f96
0x00431f96
0x00431f9b
0x00431fa3
0x00431fab
0x00431faf
0x00431fbd
0x00431fc1
0x00431fc5
0x00431fd3
0x00431fd7
0x00431fdb
0x00431fe9
0x00431fed
0x00431ff1
0x00431fff
0x00432003
0x00432007
0x00432015
0x00432019
0x0043201d
0x0043202b
0x0043202f
0x00432031
0x00432034
0x00432038
0x00000000

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a53240d1ff2e6a54c485aafc29675fea109497b1cbdbcdb71818d823280feeb
Instruction ID: 4f2c7345300522f8efab797650d0f57aff86ffded578c1633b2e6f11b4f1150f
Opcode Fuzzy Hash: 3a53240d1ff2e6a54c485aafc29675fea109497b1cbdbcdb71818d823280feeb
Instruction Fuzzy Hash: AF02BE32900235DFDB92CF6DC540109B7B6FF8A72472A82D6D854AB229D270AE52DFD1

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB4, Relevance: .2, Instructions: 210
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E0040ECB4(signed int __eax, void* __ebx, void* __ecx, void* __edx, signed int __edi, void* __esi) {
				signed char _t146;
				signed char _t147;
				signed char _t148;
				signed char _t149;
				signed char _t150;
				signed char _t151;
				signed char _t152;
				signed char _t153;
				signed char _t154;
				signed char _t155;
				signed char _t156;
				signed char _t157;
				signed char _t158;
				signed char _t159;
				signed char _t160;
				signed char _t161;
				signed char _t162;
				signed char _t163;
				signed char _t164;
				signed char _t165;
				signed char _t166;
				signed char _t167;
				signed char _t168;
				signed char _t169;
				signed char _t170;
				signed char _t171;
				signed char _t172;
				signed char _t173;
				signed char _t174;
				signed char _t175;
				signed char _t176;
				signed char _t177;
				signed char _t178;
				signed char _t179;
				signed char _t180;
				signed char _t181;
				void* _t184;
				void* _t188;
				void* _t196;
				void* _t204;
				void* _t209;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t216;
				void* _t220;
				void* _t228;
				void* _t236;
				void* _t246;

				_t146 = __eax ^ 0x00000006;
				_t184 = __ebx - 1;
				 *((intOrPtr*)(__edi + 0x340000ff)) =  *((intOrPtr*)(__edi + 0x340000ff)) + _t184;
				_push(es);
				 *((intOrPtr*)(_t146 + 0x340000ff)) =  *((intOrPtr*)(_t146 + 0x340000ff)) + _t146;
				_push(es);
				 *((intOrPtr*)(__ecx + 0x340000ff)) =  *((intOrPtr*)(__ecx + 0x340000ff)) + _t146;
				_push(es);
				 *((intOrPtr*)(__edx + 0x340000ff)) =  *((intOrPtr*)(__edx + 0x340000ff)) + _t146;
				_push(es);
				_t188 = _t184 - 0xfffffffffffffffe;
				 *((intOrPtr*)(_t188 + 0x340000ff)) =  *((intOrPtr*)(_t188 + 0x340000ff)) + _t146;
				_push(es);
				 *((intOrPtr*)(__edi + 0x6340000 + __edi * 8)) =  *((intOrPtr*)(__edi + 0x6340000 + __edi * 8)) + _t146;
				 *((intOrPtr*)(_t246 + 0x340000ff)) =  *((intOrPtr*)(_t246 + 0x340000ff)) + _t146;
				_push(es);
				 *((intOrPtr*)(__esi + 0x340000ff)) =  *((intOrPtr*)(__esi + 0x340000ff)) + _t146;
				_push(es);
				 *((intOrPtr*)(__edi + 0x340000ff)) =  *((intOrPtr*)(__edi + 0x340000ff)) + _t146;
				_push(es);
				 *((intOrPtr*)(_t146 + 0x340000ff)) =  *((intOrPtr*)(_t146 + 0x340000ff)) + __ecx;
				_push(es);
				 *((intOrPtr*)(__ecx + 0x340000ff)) =  *((intOrPtr*)(__ecx + 0x340000ff)) + __ecx;
				_push(es);
				 *((intOrPtr*)(__edx + 0x340000ff)) =  *((intOrPtr*)(__edx + 0x340000ff)) + __ecx;
				_push(es);
				_t196 = _t188 - 0xfffffffffffffffa;
				 *((intOrPtr*)(_t196 + 0x340000ff)) =  *((intOrPtr*)(_t196 + 0x340000ff)) + __ecx;
				_push(es);
				 *((intOrPtr*)(__edi + 0x6340000 + __edi * 8)) =  *((intOrPtr*)(__edi + 0x6340000 + __edi * 8)) + __ecx;
				 *((intOrPtr*)(_t246 + 0x340000ff)) =  *((intOrPtr*)(_t246 + 0x340000ff)) + __ecx;
				_push(es);
				 *((intOrPtr*)(__esi + 0x340000ff)) =  *((intOrPtr*)(__esi + 0x340000ff)) + __ecx;
				_push(es);
				 *((intOrPtr*)(__edi + 0x340000ff)) =  *((intOrPtr*)(__edi + 0x340000ff)) + __ecx;
				_push(es);
				 *((intOrPtr*)(_t146 - 1)) =  *((intOrPtr*)(_t146 - 1)) + __edx;
				 *_t146 =  *_t146 + _t146;
				_t147 = _t146 ^ 0x00000006;
				 *((intOrPtr*)(__ecx - 1)) =  *((intOrPtr*)(__ecx - 1)) + __edx;
				 *_t147 =  *_t147 + _t147;
				_t148 = _t147 ^ 0x00000006;
				 *((intOrPtr*)(__edx - 1)) =  *((intOrPtr*)(__edx - 1)) + __edx;
				 *_t148 =  *_t148 + _t148;
				_t149 = _t148 ^ 0x00000006;
				_t204 = _t196 - 0xfffffffffffffffa;
				 *((intOrPtr*)(_t204 - 1)) =  *((intOrPtr*)(_t204 - 1)) + __edx;
				 *_t149 =  *_t149 + _t149;
				_t150 = _t149 ^ 0x00000006;
				 *((intOrPtr*)(__edi + __edi * 8)) =  *((intOrPtr*)(__edi + __edi * 8)) + __edx;
				 *((intOrPtr*)(__esi + _t150)) =  *((intOrPtr*)(__esi + _t150)) + __edx;
				 *((intOrPtr*)(_t246 - 1)) =  *((intOrPtr*)(_t246 - 1)) + __edx;
				 *_t150 =  *_t150 + _t150;
				_t151 = _t150 ^ 0x00000006;
				 *((intOrPtr*)(__esi - 1)) =  *((intOrPtr*)(__esi - 1)) + __edx;
				 *_t151 =  *_t151 + _t151;
				_t152 = _t151 ^ 0x00000006;
				 *((intOrPtr*)(__edi - 1)) =  *((intOrPtr*)(__edi - 1)) + __edx;
				 *_t152 =  *_t152 + _t152;
				_t153 = _t152 ^ 0x00000006;
				_t209 = _t204 - 0xfffffffffffffffd;
				 *((intOrPtr*)(_t153 - 1)) =  *((intOrPtr*)(_t153 - 1)) + _t209;
				 *_t153 =  *_t153 + _t153;
				_t154 = _t153 ^ 0x00000006;
				_t210 = _t209 - 1;
				 *((intOrPtr*)(__ecx - 1)) =  *((intOrPtr*)(__ecx - 1)) + _t210;
				 *_t154 =  *_t154 + _t154;
				_t155 = _t154 ^ 0x00000006;
				_t211 = _t210 - 1;
				 *((intOrPtr*)(__edx - 1)) =  *((intOrPtr*)(__edx - 1)) + _t211;
				 *_t155 =  *_t155 + _t155;
				_t156 = _t155 ^ 0x00000006;
				_t212 = _t211 - 1;
				 *((intOrPtr*)(_t212 - 1)) =  *((intOrPtr*)(_t212 - 1)) + _t212;
				 *_t156 =  *_t156 + _t156;
				_t157 = _t156 ^ 0x00000006;
				_t213 = _t212 - 1;
				 *((intOrPtr*)(__edi + __edi * 8)) =  *((intOrPtr*)(__edi + __edi * 8)) + _t213;
				 *((intOrPtr*)(__esi + _t157)) =  *((intOrPtr*)(__esi + _t157)) + __edx;
				_t214 = _t213 - 1;
				 *((intOrPtr*)(_t246 - 1)) =  *((intOrPtr*)(_t246 - 1)) + _t214;
				 *_t157 =  *_t157 + _t157;
				_t158 = _t157 ^ 0x00000006;
				_t215 = _t214 - 1;
				 *((intOrPtr*)(__esi - 1)) =  *((intOrPtr*)(__esi - 1)) + _t215;
				 *_t158 =  *_t158 + _t158;
				_t159 = _t158 ^ 0x00000006;
				_t216 = _t215 - 1;
				 *((intOrPtr*)(__edi - 1)) =  *((intOrPtr*)(__edi - 1)) + _t216;
				 *_t159 =  *_t159 + _t159;
				_t160 = _t159 ^ 0x00000006;
				 *((intOrPtr*)(_t160 - 1)) =  *((intOrPtr*)(_t160 - 1)) + _t160;
				 *_t160 =  *_t160 + _t160;
				_t161 = _t160 ^ 0x00000006;
				 *((intOrPtr*)(__ecx - 1)) =  *((intOrPtr*)(__ecx - 1)) + _t161;
				 *_t161 =  *_t161 + _t161;
				_t162 = _t161 ^ 0x00000006;
				 *((intOrPtr*)(__edx - 1)) =  *((intOrPtr*)(__edx - 1)) + _t162;
				 *_t162 =  *_t162 + _t162;
				_t163 = _t162 ^ 0x00000006;
				_t220 = _t216 - 0xfffffffffffffffe;
				 *((intOrPtr*)(_t220 - 1)) =  *((intOrPtr*)(_t220 - 1)) + _t163;
				 *_t163 =  *_t163 + _t163;
				_t164 = _t163 ^ 0x00000006;
				 *((intOrPtr*)(__edi + __edi * 8)) =  *((intOrPtr*)(__edi + __edi * 8)) + _t164;
				 *((intOrPtr*)(__esi + _t164)) =  *((intOrPtr*)(__esi + _t164)) + __edx;
				 *((intOrPtr*)(_t246 - 1)) =  *((intOrPtr*)(_t246 - 1)) + _t164;
				 *_t164 =  *_t164 + _t164;
				_t165 = _t164 ^ 0x00000006;
				 *((intOrPtr*)(__esi - 1)) =  *((intOrPtr*)(__esi - 1)) + _t165;
				 *_t165 =  *_t165 + _t165;
				_t166 = _t165 ^ 0x00000006;
				 *((intOrPtr*)(__edi - 1)) =  *((intOrPtr*)(__edi - 1)) + _t166;
				 *_t166 =  *_t166 + _t166;
				_t167 = _t166 ^ 0x00000006;
				 *((intOrPtr*)(_t167 - 1)) =  *((intOrPtr*)(_t167 - 1)) + __ecx;
				 *_t167 =  *_t167 + _t167;
				_t168 = _t167 ^ 0x00000006;
				 *((intOrPtr*)(__ecx - 1)) =  *((intOrPtr*)(__ecx - 1)) + __ecx;
				 *_t168 =  *_t168 + _t168;
				_t169 = _t168 ^ 0x00000006;
				 *((intOrPtr*)(__edx - 1)) =  *((intOrPtr*)(__edx - 1)) + __ecx;
				 *_t169 =  *_t169 + _t169;
				_t170 = _t169 ^ 0x00000006;
				_t228 = _t220 - 0xfffffffffffffffa;
				 *((intOrPtr*)(_t228 - 1)) =  *((intOrPtr*)(_t228 - 1)) + __ecx;
				 *_t170 =  *_t170 + _t170;
				_t171 = _t170 ^ 0x00000006;
				 *((intOrPtr*)(__edi + __edi * 8)) =  *((intOrPtr*)(__edi + __edi * 8)) + __ecx;
				 *((intOrPtr*)(__esi + _t171)) =  *((intOrPtr*)(__esi + _t171)) + __edx;
				 *((intOrPtr*)(_t246 - 1)) =  *((intOrPtr*)(_t246 - 1)) + __ecx;
				 *_t171 =  *_t171 + _t171;
				_t172 = _t171 ^ 0x00000006;
				 *((intOrPtr*)(__esi - 1)) =  *((intOrPtr*)(__esi - 1)) + __ecx;
				 *_t172 =  *_t172 + _t172;
				_t173 = _t172 ^ 0x00000006;
				 *((intOrPtr*)(__edi - 1)) =  *((intOrPtr*)(__edi - 1)) + __ecx;
				 *_t173 =  *_t173 + _t173;
				_t174 = _t173 ^ 0x00000006;
				 *((intOrPtr*)(_t174 - 1)) =  *((intOrPtr*)(_t174 - 1)) + __edx;
				 *_t174 =  *_t174 + _t174;
				_t175 = _t174 ^ 0x00000006;
				 *((intOrPtr*)(__ecx - 1)) =  *((intOrPtr*)(__ecx - 1)) + __edx;
				 *_t175 =  *_t175 + _t175;
				_t176 = _t175 ^ 0x00000006;
				 *((intOrPtr*)(__edx - 1)) =  *((intOrPtr*)(__edx - 1)) + __edx;
				 *_t176 =  *_t176 + _t176;
				_t177 = _t176 ^ 0x00000006;
				_t236 = _t228 - 0xfffffffffffffffa;
				 *((intOrPtr*)(_t236 - 1)) =  *((intOrPtr*)(_t236 - 1)) + __edx;
				 *_t177 =  *_t177 + _t177;
				_t178 = _t177 ^ 0x00000006;
				 *((intOrPtr*)(__edi + __edi * 8)) =  *((intOrPtr*)(__edi + __edi * 8)) + __edx;
				 *((intOrPtr*)(__esi + _t178)) =  *((intOrPtr*)(__esi + _t178)) + __edx;
				 *((intOrPtr*)(_t246 - 1)) =  *((intOrPtr*)(_t246 - 1)) + __edx;
				 *_t178 =  *_t178 + _t178;
				_t179 = _t178 ^ 0x00000006;
				 *((intOrPtr*)(__esi - 1)) =  *((intOrPtr*)(__esi - 1)) + __edx;
				 *_t179 =  *_t179 + _t179;
				_t180 = _t179 ^ 0x00000006;
				 *((intOrPtr*)(__edi - 1)) =  *((intOrPtr*)(__edi - 1)) + __edx;
				 *_t180 =  *_t180 + _t180;
				_t181 = _t180 ^ 0x00000006;
				 *((intOrPtr*)(_t181 - 1)) =  *((intOrPtr*)(_t181 - 1)) + _t236 - 0xfffffffffffffffd;
				 *_t181 =  *_t181 + _t181;
				return 0x40ee8a;
			}

0x0040ecb4
0x0040ecb6
0x0040ecb7
0x0040ecbd
0x0040ecbf
0x0040ecc5
0x0040ecc7
0x0040eccd
0x0040eccf
0x0040ecd5
0x0040ecd6
0x0040ecd7
0x0040ecdd
0x0040ecdf
0x0040ece7
0x0040eced
0x0040ecef
0x0040ecf5
0x0040ecf7
0x0040ecfd
0x0040ecff
0x0040ed05
0x0040ed07
0x0040ed0d
0x0040ed0f
0x0040ed15
0x0040ed16
0x0040ed17
0x0040ed1d
0x0040ed1f
0x0040ed27
0x0040ed2d
0x0040ed2f
0x0040ed35
0x0040ed37
0x0040ed3d
0x0040ed3f
0x0040ed42
0x0040ed44
0x0040ed47
0x0040ed4a
0x0040ed4c
0x0040ed4f
0x0040ed52
0x0040ed54
0x0040ed56
0x0040ed57
0x0040ed5a
0x0040ed5c
0x0040ed5f
0x0040ed63
0x0040ed67
0x0040ed6a
0x0040ed6c
0x0040ed6f
0x0040ed72
0x0040ed74
0x0040ed77
0x0040ed7a
0x0040ed7c
0x0040ed7e
0x0040ed7f
0x0040ed82
0x0040ed84
0x0040ed86
0x0040ed87
0x0040ed8a
0x0040ed8c
0x0040ed8e
0x0040ed8f
0x0040ed92
0x0040ed94
0x0040ed96
0x0040ed97
0x0040ed9a
0x0040ed9c
0x0040ed9e
0x0040ed9f
0x0040eda3
0x0040eda6
0x0040eda7
0x0040edaa
0x0040edac
0x0040edae
0x0040edaf
0x0040edb2
0x0040edb4
0x0040edb6
0x0040edb7
0x0040edba
0x0040edbc
0x0040edbf
0x0040edc2
0x0040edc4
0x0040edc7
0x0040edca
0x0040edcc
0x0040edcf
0x0040edd2
0x0040edd4
0x0040edd6
0x0040edd7
0x0040edda
0x0040eddc
0x0040eddf
0x0040ede3
0x0040ede7
0x0040edea
0x0040edec
0x0040edef
0x0040edf2
0x0040edf4
0x0040edf7
0x0040edfa
0x0040edfc
0x0040edff
0x0040ee02
0x0040ee04
0x0040ee07
0x0040ee0a
0x0040ee0c
0x0040ee0f
0x0040ee12
0x0040ee14
0x0040ee16
0x0040ee17
0x0040ee1a
0x0040ee1c
0x0040ee1f
0x0040ee23
0x0040ee27
0x0040ee2a
0x0040ee2c
0x0040ee2f
0x0040ee32
0x0040ee34
0x0040ee37
0x0040ee3a
0x0040ee3c
0x0040ee3f
0x0040ee42
0x0040ee44
0x0040ee47
0x0040ee4a
0x0040ee4c
0x0040ee4f
0x0040ee52
0x0040ee54
0x0040ee56
0x0040ee57
0x0040ee5a
0x0040ee5c
0x0040ee5f
0x0040ee63
0x0040ee67
0x0040ee6a
0x0040ee6c
0x0040ee6f
0x0040ee72
0x0040ee74
0x0040ee77
0x0040ee7a
0x0040ee7c
0x0040ee7f
0x0040ee82
0x0040ee89

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622fbd8048fd543cdc2cb0be557f41394da94c826b34e88aea9dfaf07a3619e9
Instruction ID: 2cea75af83b0793a95f332b946a4bc9c29eeecd7935183ae600d0464b4d82da5
Opcode Fuzzy Hash: 622fbd8048fd543cdc2cb0be557f41394da94c826b34e88aea9dfaf07a3619e9
Instruction Fuzzy Hash: 3371B7015EEBCA6FCB97833008A85D6AF61AE5316578B53EBCC818E497914D241EF372

Uniqueness

Uniqueness Score: -1.00%

Function 00405AC0, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64

Uniqueness

Uniqueness Score: -1.00%

Function 00427760, Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00427760() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleW(L"oleaut32.dll");
				 *0x4b30e4 = E00427734("VariantChangeTypeEx", E00427150, _t91);
				 *0x4b30e8 = E00427734("VarNeg", E00427198, _t91);
				 *0x4b30ec = E00427734("VarNot", E00427198, _t91);
				 *0x4b30f0 = E00427734("VarAdd", E004271A4, _t91);
				 *0x4b30f4 = E00427734("VarSub", E004271A4, _t91);
				 *0x4b30f8 = E00427734("VarMul", E004271A4, _t91);
				 *0x4b30fc = E00427734("VarDiv", E004271A4, _t91);
				 *0x4b3100 = E00427734("VarIdiv", E004271A4, _t91);
				 *0x4b3104 = E00427734("VarMod", E004271A4, _t91);
				 *0x4b3108 = E00427734("VarAnd", E004271A4, _t91);
				 *0x4b310c = E00427734("VarOr", E004271A4, _t91);
				 *0x4b3110 = E00427734("VarXor", E004271A4, _t91);
				 *0x4b3114 = E00427734("VarCmp", E004271B0, _t91);
				 *0x4b3118 = E00427734("VarI4FromStr", E004271BC, _t91);
				 *0x4b311c = E00427734("VarR4FromStr", E00427228, _t91);
				 *0x4b3120 = E00427734("VarR8FromStr", E00427298, _t91);
				 *0x4b3124 = E00427734("VarDateFromStr", E00427308, _t91);
				 *0x4b3128 = E00427734("VarCyFromStr", E00427378, _t91);
				 *0x4b312c = E00427734("VarBoolFromStr", E004273E8, _t91);
				 *0x4b3130 = E00427734("VarBstrFromCy", E00427468, _t91);
				 *0x4b3134 = E00427734("VarBstrFromDate", E00427510, _t91);
				_t46 = E00427734("VarBstrFromBool", E004276A0, _t91);
				 *0x4b3138 = _t46;
				return _t46;
			}

0x0042776e
0x00427782
0x00427798
0x004277ae
0x004277c4
0x004277da
0x004277f0
0x00427806
0x0042781c
0x00427832
0x00427848
0x0042785e
0x00427874
0x0042788a
0x004278a0
0x004278b6
0x004278cc
0x004278e2
0x004278f8
0x0042790e
0x00427924
0x0042793a
0x0042794a
0x00427950
0x00427957

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 00427769

Part of subcall function 00427734: GetProcAddress.KERNEL32(00000000), ref: 0042774D

Strings

VarDateFromStr, xrefs: 004278D7
VarCmp, xrefs: 0042787F
VarIdiv, xrefs: 00427811
VarI4FromStr, xrefs: 00427895
oleaut32.dll, xrefs: 00427764
VarBoolFromStr, xrefs: 00427903
VarAdd, xrefs: 004277B9
VarDiv, xrefs: 004277FB
VarBstrFromCy, xrefs: 00427919
VarMod, xrefs: 00427827
VarAnd, xrefs: 0042783D
VarBstrFromDate, xrefs: 0042792F
VarCyFromStr, xrefs: 004278ED
VarOr, xrefs: 00427853
VarMul, xrefs: 004277E5
VarR8FromStr, xrefs: 004278C1
VarNeg, xrefs: 0042778D
VariantChangeTypeEx, xrefs: 00427777
VarNot, xrefs: 004277A3
VarBstrFromBool, xrefs: 00427945
VarR4FromStr, xrefs: 004278AB
VarSub, xrefs: 004277CF
VarXor, xrefs: 00427869

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 48e8c45941e3087f339835e92e208a9ec034c2b79a5d31d0d58655ea58982c29
Instruction ID: 0d53f7084111da00e6f8be9bb035bcb00c42a4e9e77ce097fa9a4c868214a819
Opcode Fuzzy Hash: 48e8c45941e3087f339835e92e208a9ec034c2b79a5d31d0d58655ea58982c29
Instruction Fuzzy Hash: 224109A070D2349BA308AB6FB84243AB798DB857143E4C17FB8048A745DF38B981C66D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E8EC, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 194
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041E8EC(void* __eax, void* __ebx, signed int __edx, void* __edi, void* __esi, long long __fp0) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _t32;
				signed int _t53;
				signed int _t56;
				signed int _t71;
				signed int _t78;
				signed int* _t82;
				signed int _t85;
				void* _t93;
				signed int _t94;
				signed int _t95;
				signed int _t98;
				signed int _t99;
				void* _t105;
				intOrPtr _t106;
				signed int _t109;
				intOrPtr _t116;
				intOrPtr _t117;
				void* _t131;
				void* _t132;
				signed int _t134;
				void* _t136;
				void* _t137;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				long long _t161;

				_t161 = __fp0;
				_t126 = __edi;
				_t109 = __edx;
				_t139 = _t140;
				_t141 = _t140 + 0xfffffff0;
				_push(__edi);
				_v12 = 0;
				_v8 = __edx;
				_t93 = __eax;
				_push(_t139);
				_push(0x41eb81);
				_push( *[fs:eax]);
				 *[fs:eax] = _t141;
				_t32 =  *0x4ac590; // 0x4ad8f8
				_t144 =  *_t32;
				if( *_t32 == 0) {
					E0040552C(0x1a);
				}
				E0040665C(E004068E0( *0x4b07e4, 0, _t126), _t109 | 0xffffffff, _t144);
				_push(_t139);
				_push(0x41eb64);
				_push( *[fs:edx]);
				 *[fs:edx] = _t141;
				 *0x4b07dc = 0;
				_push(0);
				E00409F74();
				_t142 = _t141 + 4;
				E0041E154(_t93, 0x41eb9c, 0x100b,  &_v12);
				_t127 = E0041A2E4(0x41eb9c, 1, _t144);
				if(_t127 + 0xfffffffd - 3 >= 0) {
					__eflags = _t127 - 0xffffffffffffffff;
					if(_t127 - 0xffffffffffffffff < 0) {
						 *0x4b07dc = 1;
						_push(1);
						E00409F74();
						_t142 = _t142 + 4;
						E00407DD4( *0x4b07e0, L"B.C.");
						 *((intOrPtr*)( *0x4b07e0 + 4)) = 0;
						_t71 =  *0x4b07e0;
						 *((intOrPtr*)(_t71 + 8)) = 0xffc00000;
						 *((intOrPtr*)(_t71 + 0xc)) = 0xc1dfffff;
						E0041C2E4(1, 1, 1, __eflags, _t161);
						_v20 = E00405770();
						_v16 = 1;
						asm("fild qword [ebp-0x10]");
						 *((long long*)( *0x4b07e0 + 0x10)) = _t161;
						asm("wait");
						EnumCalendarInfoW(E0041E7C4, GetThreadLocale(), _t127, 4);
						_t78 =  *0x4b07e0;
						__eflags = _t78;
						if(_t78 != 0) {
							_t82 = _t78 - 4;
							__eflags = _t82;
							_t78 =  *_t82;
						}
						_t134 = _t78 - 1;
						__eflags = _t134;
						if(_t134 > 0) {
							_t98 = 1;
							do {
								 *((intOrPtr*)( *0x4b07e0 + 4 + (_t98 + _t98 * 2) * 8)) = 0xffffffff;
								_t98 = _t98 + 1;
								_t134 = _t134 - 1;
								__eflags = _t134;
							} while (_t134 != 0);
						}
						EnumCalendarInfoW(E0041E85C, GetThreadLocale(), _t127, 3);
					}
				} else {
					EnumCalendarInfoW(E0041E7C4, GetThreadLocale(), _t127, 4);
					_t85 =  *0x4b07e0;
					if(_t85 != 0) {
						_t85 =  *(_t85 - 4);
					}
					_t136 = _t85 - 1;
					if(_t136 >= 0) {
						_t137 = _t136 + 1;
						_t99 = 0;
						do {
							 *((intOrPtr*)( *0x4b07e0 + 4 + (_t99 + _t99 * 2) * 8)) = 0xffffffff;
							_t99 = _t99 + 1;
							_t137 = _t137 - 1;
						} while (_t137 != 0);
					}
					EnumCalendarInfoW(E0041E85C, GetThreadLocale(), _t127, 3);
				}
				_t94 =  *0x4b07e0;
				if(_t94 != 0) {
					_t94 =  *(_t94 - 4);
				}
				_push(_t94);
				E00409F74();
				_t53 =  *0x4b07e0;
				if(_t53 != 0) {
					_t53 =  *(_t53 - 4);
				}
				_t131 = _t53 - 1;
				if(_t131 >= 0) {
					_t132 = _t131 + 1;
					_t95 = 0;
					do {
						_t127 = _t95 + _t95 * 2;
						_t106 =  *0x416f2c; // 0x416f30
						E00409010( *((intOrPtr*)(_v8 + 0xbc)) + (_t95 + _t95 * 2) * 8, _t106,  *0x4b07e0 + (_t95 + _t95 * 2) * 8);
						_t95 = _t95 + 1;
						_t132 = _t132 - 1;
					} while (_t132 != 0);
				}
				_t116 =  *0x41e720; // 0x41e724
				E0040A098(0x4b07e0, _t116);
				_t56 =  *0x4b07e0;
				if(_t56 != 0) {
					_t56 =  *(_t56 - 4);
				}
				 *0x4b07dc = _t56;
				_pop(_t117);
				_pop(_t105);
				 *[fs:eax] = _t117;
				_push(0x41eb6b);
				return E0040683C( *0x4b07e4, _t105, _t127);
			}

0x0041e8ec
0x0041e8ec
0x0041e8ec
0x0041e8ed
0x0041e8ef
0x0041e8f4
0x0041e8f7
0x0041e8fa
0x0041e8fd
0x0041e901
0x0041e902
0x0041e907
0x0041e90a
0x0041e90d
0x0041e912
0x0041e915
0x0041e919
0x0041e919
0x0041e92b
0x0041e932
0x0041e933
0x0041e938
0x0041e93b
0x0041e940
0x0041e946
0x0041e957
0x0041e95c
0x0041e96f
0x0041e981
0x0041e98b
0x0041e9e8
0x0041e9eb
0x0041e9f6
0x0041e9fc
0x0041ea0d
0x0041ea12
0x0041ea1f
0x0041ea2b
0x0041ea2e
0x0041ea33
0x0041ea3a
0x0041ea4d
0x0041ea57
0x0041ea5a
0x0041ea5d
0x0041ea65
0x0041ea68
0x0041ea77
0x0041ea7c
0x0041ea81
0x0041ea83
0x0041ea85
0x0041ea85
0x0041ea88
0x0041ea88
0x0041ea8c
0x0041ea8d
0x0041ea8f
0x0041ea91
0x0041ea96
0x0041ea9f
0x0041eaa7
0x0041eaa8
0x0041eaa8
0x0041eaa8
0x0041ea96
0x0041eab9
0x0041eab9
0x0041e98d
0x0041e99b
0x0041e9a0
0x0041e9a7
0x0041e9ac
0x0041e9ac
0x0041e9b0
0x0041e9b3
0x0041e9b5
0x0041e9b6
0x0041e9b8
0x0041e9c1
0x0041e9c9
0x0041e9ca
0x0041e9ca
0x0041e9b8
0x0041e9db
0x0041e9db
0x0041eac3
0x0041eac7
0x0041eacc
0x0041eacc
0x0041eace
0x0041eae2
0x0041eaea
0x0041eaf1
0x0041eaf6
0x0041eaf6
0x0041eafa
0x0041eafd
0x0041eaff
0x0041eb00
0x0041eb02
0x0041eb02
0x0041eb1a
0x0041eb20
0x0041eb25
0x0041eb26
0x0041eb26
0x0041eb02
0x0041eb2e
0x0041eb34
0x0041eb39
0x0041eb40
0x0041eb45
0x0041eb45
0x0041eb47
0x0041eb4e
0x0041eb50
0x0041eb51
0x0041eb54
0x0041eb63

APIs

GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041E990
EnumCalendarInfoW.KERNEL32(0041E7C4,00000000,00000000,00000004), ref: 0041E99B
GetThreadLocale.KERNEL32(00000000,00000003,0041E7C4,00000000,00000000,00000004), ref: 0041E9D0
EnumCalendarInfoW.KERNEL32(0041E85C,00000000,00000000,00000003,0041E7C4,00000000,00000000,00000004), ref: 0041E9DB
GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041EA6C
EnumCalendarInfoW.KERNEL32(0041E7C4,00000000,00000000,00000004), ref: 0041EA77
GetThreadLocale.KERNEL32(00000000,00000003,0041E7C4,00000000,00000000,00000004), ref: 0041EAAE
EnumCalendarInfoW.KERNEL32(0041E85C,00000000,00000000,00000003,0041E7C4,00000000,00000000,00000004), ref: 0041EAB9

Strings

0oA, xrefs: 0041EB1A
hpA, xrefs: 0041EADC
B.C., xrefs: 0041EA1A
$A, xrefs: 0041E951, 0041EA07, 0041EB2E

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: CalendarEnumInfoLocaleThread
String ID: $A$0oA$B.C.$hpA
API String ID: 683597275-4049206235
Opcode ID: 586092908fac795f1ae75f7d09ce9ba69cd4a05a951f472f02cb7e4a83f9f400
Instruction ID: 31764f9b4395ddee8a33e7efece694c8c2e23c621918c970f88beb3215b81749
Opcode Fuzzy Hash: 586092908fac795f1ae75f7d09ce9ba69cd4a05a951f472f02cb7e4a83f9f400
Instruction Fuzzy Hash: 1B61B6746012019FD710DF6ACC81A9AB765FB44354F10867AF911973E5DA38ED81CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A5C4, Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A5C4() {
				signed int _t2;
				_Unknown_base(*)()* _t8;

				InitializeCriticalSection(0x4afc10);
				 *0x4afc28 = 0x7f;
				_t2 = GetVersion() & 0x000000ff;
				 *0x4afc0c = _t2 - 6 >= 0;
				if( *0x4afc0c != 0) {
					 *0x4afc00 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetThreadPreferredUILanguages");
					 *0x4afc04 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "SetThreadPreferredUILanguages");
					_t8 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetThreadUILanguage");
					 *0x4afc08 = _t8;
					return _t8;
				}
				return _t2;
			}

0x0040a5c9
0x0040a5ce
0x0040a5dc
0x0040a5e4
0x0040a5f2
0x0040a609
0x0040a623
0x0040a638
0x0040a63d
0x00000000
0x0040a63d
0x0040a642

APIs

InitializeCriticalSection.KERNEL32(004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A5C9
GetVersion.KERNEL32(004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A5D7
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A5FE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A604
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A618
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A61E
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004AFC10,004A7037,00000400,00000000,004A70D7), ref: 0040A632
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A638

Strings

kernel32.dll, xrefs: 0040A5F9, 0040A613, 0040A62D
GetThreadPreferredUILanguages, xrefs: 0040A5F4
SetThreadPreferredUILanguages, xrefs: 0040A60E
GetThreadUILanguage, xrefs: 0040A628

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 93963328a1992207510c5a143f88d452738f2b7cd2c03137b8683a113ef3510e
Instruction ID: 77c12324a04305e01794a5ee660b83a9054d5f7758015fb80e29bcc474d3137b
Opcode Fuzzy Hash: 93963328a1992207510c5a143f88d452738f2b7cd2c03137b8683a113ef3510e
Instruction Fuzzy Hash: 9AF012A09813453CE6207FF79C0BB181D286A1271AF684C7BB880B62D3CEBE4654971E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1CC, Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 216
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041E1CC(int __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				int _t55;
				void* _t121;
				void* _t128;
				void* _t151;
				void* _t152;
				intOrPtr _t172;
				intOrPtr _t204;
				signed short _t212;
				int _t214;
				intOrPtr _t216;
				intOrPtr _t217;
				void* _t224;

				_t224 = __fp0;
				_t211 = __edi;
				_t216 = _t217;
				_t152 = 7;
				do {
					_push(0);
					_push(0);
					_t152 = _t152 - 1;
				} while (_t152 != 0);
				_push(__edi);
				_t151 = __edx;
				_t214 = __eax;
				_push(_t216);
				_push(0x41e4b1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				_t55 = IsValidLocale(__eax, 1);
				_t219 = _t55;
				if(_t55 == 0) {
					_t214 = GetThreadLocale();
				}
				_t172 =  *0x417064; // 0x417068
				E0040A098(_t151 + 0xbc, _t172);
				E0041E8EC(_t214, _t151, _t151, _t211, _t214, _t224);
				E0041E5C0(_t214, _t151, _t151, _t211, _t214);
				E0041E67C(_t214, _t151, _t151, _t211, _t214);
				E0041E154(_t214, 0, 0x14,  &_v20);
				E00407DD4(_t151, _v20);
				E0041E154(_t214, 0x41e4cc, 0x1b,  &_v24);
				 *((char*)(_t151 + 4)) = E0041A2E4(0x41e4cc, 0, _t219);
				E0041E154(_t214, 0x41e4cc, 0x1c,  &_v28);
				 *((char*)(_t151 + 0xc6)) = E0041A2E4(0x41e4cc, 0, _t219);
				 *((short*)(_t151 + 0xc0)) = E0041E1A0(_t214, 0x2c, 0xf);
				 *((short*)(_t151 + 0xc2)) = E0041E1A0(_t214, 0x2e, 0xe);
				E0041E154(_t214, 0x41e4cc, 0x19,  &_v32);
				 *((char*)(_t151 + 5)) = E0041A2E4(0x41e4cc, 0, _t219);
				_t212 = E0041E1A0(_t214, 0x2f, 0x1d);
				 *(_t151 + 6) = _t212;
				_push(_t212);
				E0041EC38(_t214, _t151, L"m/d/yy", 0x1f, _t212, _t214, _t219,  &_v36);
				E00407DD4(_t151 + 0xc, _v36);
				_push( *(_t151 + 6) & 0x0000ffff);
				E0041EC38(_t214, _t151, L"mmmm d, yyyy", 0x20, _t212, _t214, _t219,  &_v40);
				E00407DD4(_t151 + 0x10, _v40);
				 *((short*)(_t151 + 8)) = E0041E1A0(_t214, 0x3a, 0x1e);
				E0041E154(_t214, 0x41e520, 0x28,  &_v44);
				E00407DD4(_t151 + 0x14, _v44);
				E0041E154(_t214, 0x41e534, 0x29,  &_v48);
				E00407DD4(_t151 + 0x18, _v48);
				E004079F4( &_v12);
				E004079F4( &_v16);
				E0041E154(_t214, 0x41e4cc, 0x25,  &_v52);
				_t121 = E0041A2E4(0x41e4cc, 0, _t219);
				_t220 = _t121;
				if(_t121 != 0) {
					E00407E1C( &_v8, 0x41e558);
				} else {
					E00407E1C( &_v8, 0x41e548);
				}
				E0041E154(_t214, 0x41e4cc, 0x23,  &_v56);
				_t128 = E0041A2E4(0x41e4cc, 0, _t220);
				_t221 = _t128;
				if(_t128 == 0) {
					E0041E154(_t214, 0x41e4cc, 0x1005,  &_v60);
					if(E0041A2E4(0x41e4cc, 0, _t221) != 0) {
						E00407E1C( &_v12, L"AMPM ");
					} else {
						E00407E1C( &_v16, L" AMPM");
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E004087A4(_t151 + 0x1c, _t151, 4, _t212, _t214);
				_push(_v12);
				_push(_v8);
				_push(L":mm:ss");
				_push(_v16);
				E004087A4(_t151 + 0x20, _t151, 4, _t212, _t214);
				 *((short*)(_t151 + 0xa)) = E0041E1A0(_t214, 0x2c, 0xc);
				 *((short*)(_t151 + 0xc4)) = 0x32;
				_pop(_t204);
				 *[fs:eax] = _t204;
				_push(0x41e4b8);
				return E00407A54( &_v60, 0xe);
			}

0x0041e1cc
0x0041e1cc
0x0041e1cd
0x0041e1cf
0x0041e1d4
0x0041e1d4
0x0041e1d6
0x0041e1d8
0x0041e1d8
0x0041e1dd
0x0041e1de
0x0041e1e0
0x0041e1e4
0x0041e1e5
0x0041e1ea
0x0041e1ed
0x0041e1f3
0x0041e1f8
0x0041e1fa
0x0041e201
0x0041e201
0x0041e209
0x0041e20f
0x0041e218
0x0041e221
0x0041e22a
0x0041e23c
0x0041e246
0x0041e25b
0x0041e26a
0x0041e27d
0x0041e28c
0x0041e2a2
0x0041e2b9
0x0041e2d0
0x0041e2df
0x0041e2f2
0x0041e2f4
0x0041e2f8
0x0041e309
0x0041e314
0x0041e31d
0x0041e32e
0x0041e339
0x0041e34e
0x0041e362
0x0041e36d
0x0041e382
0x0041e38d
0x0041e395
0x0041e39d
0x0041e3b2
0x0041e3bc
0x0041e3c1
0x0041e3c3
0x0041e3dc
0x0041e3c5
0x0041e3cd
0x0041e3cd
0x0041e3f1
0x0041e3fb
0x0041e400
0x0041e402
0x0041e414
0x0041e425
0x0041e43e
0x0041e427
0x0041e42f
0x0041e42f
0x0041e425
0x0041e443
0x0041e446
0x0041e449
0x0041e44e
0x0041e459
0x0041e45e
0x0041e461
0x0041e464
0x0041e469
0x0041e474
0x0041e489
0x0041e48d
0x0041e498
0x0041e49b
0x0041e49e
0x0041e4b0

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,0041E4B1,?,?,?,?,00000000,00000000), ref: 0041E1F3
GetThreadLocale.KERNEL32(?,00000001,00000000,0041E4B1,?,?,?,?,00000000,00000000), ref: 0041E1FC

Part of subcall function 0041E1A0: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,0041E2A2,?,00000001,00000000,0041E4B1), ref: 0041E1B3

Part of subcall function 0041E154: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041E172

Strings

:mm:ss, xrefs: 0041E464
2, xrefs: 0041E48D
m/d/yy, xrefs: 0041E2FD
:mm, xrefs: 0041E449
hpA, xrefs: 0041E209
AMPM , xrefs: 0041E439
AMPM, xrefs: 0041E42A
mmmm d, yyyy, xrefs: 0041E322

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $hpA$m/d/yy$mmmm d, yyyy
API String ID: 233154393-3514583240
Opcode ID: cd2e1eec404eaaf93342958035b3c9dc4f4edd91dbf45419f82dac3ab0a37c82
Instruction ID: 439dc5afb6c92fd399cedb1891f988b7bb4968893a10f06eaf7ea53368b32677
Opcode Fuzzy Hash: cd2e1eec404eaaf93342958035b3c9dc4f4edd91dbf45419f82dac3ab0a37c82
Instruction Fuzzy Hash: D57123387001496BDB05EBA7C881ADE76A6EF88304F50847BF904AB346D63DDD86875E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB58, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0040AB58(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t18;
				signed short _t28;
				intOrPtr _t35;
				intOrPtr* _t44;
				intOrPtr _t47;

				_t42 = __edi;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t44 = __edx;
				_t28 = __eax;
				_push(_t47);
				_push(0x40ac5c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t47;
				EnterCriticalSection(0x4afc10);
				if(_t28 !=  *0x4afc28) {
					LeaveCriticalSection(0x4afc10);
					E004079F4(_t44);
					if(IsValidLocale(_t28 & 0x0000ffff, 2) != 0) {
						if( *0x4afc0c == 0) {
							_t18 = E0040A840(_t28, _t28, _t44, __edi, _t44);
							L00403738();
							if(_t28 != _t18) {
								if( *_t44 != 0) {
									_t18 = E004086C4(_t44, E0040AC74);
								}
								L00403738();
								E0040A840(_t18, _t28,  &_v8, _t42, _t44);
								E004086C4(_t44, _v8);
							}
						} else {
							E0040AA3C(_t28, _t44);
						}
					}
					EnterCriticalSection(0x4afc10);
					 *0x4afc28 = _t28;
					E0040A6C0(0x4afc2a, E004084C8( *_t44), 0xaa);
					LeaveCriticalSection(0x4afc10);
				} else {
					E0040856C(_t44, 0x55, 0x4afc2a);
					LeaveCriticalSection(0x4afc10);
				}
				_pop(_t35);
				 *[fs:eax] = _t35;
				_push(E0040AC63);
				return E004079F4( &_v8);
			}

0x0040ab58
0x0040ab5b
0x0040ab5d
0x0040ab5e
0x0040ab5f
0x0040ab61
0x0040ab65
0x0040ab66
0x0040ab6b
0x0040ab6e
0x0040ab76
0x0040ab82
0x0040aba9
0x0040abb0
0x0040abc2
0x0040abcb
0x0040abdc
0x0040abe1
0x0040abe9
0x0040abee
0x0040abf7
0x0040abf7
0x0040abfc
0x0040ac04
0x0040ac0e
0x0040ac0e
0x0040abcd
0x0040abd1
0x0040abd1
0x0040abcb
0x0040ac18
0x0040ac1d
0x0040ac37
0x0040ac41
0x0040ab84
0x0040ab90
0x0040ab9a
0x0040ab9a
0x0040ac48
0x0040ac4b
0x0040ac4e
0x0040ac5b

APIs

EnterCriticalSection.KERNEL32(004AFC10,00000000,0040AC5C,?,?,?,00000000,?,0040B53C,00000000,0040B59B,?,?,00000000,00000000,00000000), ref: 0040AB76
LeaveCriticalSection.KERNEL32(004AFC10,004AFC10,00000000,0040AC5C,?,?,?,00000000,?,0040B53C,00000000,0040B59B,?,?,00000000,00000000), ref: 0040AB9A
LeaveCriticalSection.KERNEL32(004AFC10,004AFC10,00000000,0040AC5C,?,?,?,00000000,?,0040B53C,00000000,0040B59B,?,?,00000000,00000000), ref: 0040ABA9
IsValidLocale.KERNEL32(00000000,00000002,004AFC10,004AFC10,00000000,0040AC5C,?,?,?,00000000,?,0040B53C,00000000,0040B59B), ref: 0040ABBB
EnterCriticalSection.KERNEL32(004AFC10,00000000,00000002,004AFC10,004AFC10,00000000,0040AC5C,?,?,?,00000000,?,0040B53C,00000000,0040B59B), ref: 0040AC18
LeaveCriticalSection.KERNEL32(004AFC10,004AFC10,00000000,00000002,004AFC10,004AFC10,00000000,0040AC5C,?,?,?,00000000,?,0040B53C,00000000,0040B59B), ref: 0040AC41

Strings

en-US,en,, xrefs: 0040AB86, 0040AC2D

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-US,en,
API String ID: 975949045-3579323720
Opcode ID: df8d0f686803062bdab142a1b2de24a95a5c3d65ff11807a0e019821b71cc122
Instruction ID: 583594d50a991121d5869f76381f812cea75c141c18cde3dbdefc2834495f508
Opcode Fuzzy Hash: df8d0f686803062bdab142a1b2de24a95a5c3d65ff11807a0e019821b71cc122
Instruction Fuzzy Hash: 6721016074434477E620BBA78C03B2A2598AB46718FA1883BB540B73D2DE7C8D65836F

Uniqueness

Uniqueness Score: -1.00%

Function 00422F10, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82
registryCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00422F10(void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr* _t21;
				intOrPtr _t61;
				void* _t68;

				_push(__ebx);
				_v20 = 0;
				_v8 = 0;
				_push(_t68);
				_push(0x42300a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t68 + 0xfffffff0;
				_t21 = E0040E4A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"GetUserDefaultUILanguage");
				if(_t21 == 0) {
					if(E0042004C() != 2) {
						if(E00422EE8(0, L"Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v12, 1, 0) == 0) {
							E00422EDC();
							RegCloseKey(_v12);
						}
					} else {
						if(E00422EE8(0, L".DEFAULT\\Control Panel\\International", 0x80000003,  &_v12, 1, 0) == 0) {
							E00422EDC();
							RegCloseKey(_v12);
						}
					}
					E0040871C( &_v20, _v8, 0x423120);
					E00405900(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					 *_t21();
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E00423011);
				E004079F4( &_v20);
				return E004079F4( &_v8);
			}

0x00422f16
0x00422f19
0x00422f1c
0x00422f21
0x00422f22
0x00422f27
0x00422f2a
0x00422f3d
0x00422f44
0x00422f57
0x00422fac
0x00422fb9
0x00422fc2
0x00422fc2
0x00422f59
0x00422f74
0x00422f81
0x00422f8a
0x00422f8a
0x00422f74
0x00422fd2
0x00422fdd
0x00422fe8
0x00422fe8
0x00422f46
0x00422f46
0x00422f48
0x00422fee
0x00422ff1
0x00422ff4
0x00422ffc
0x00423009

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042300A), ref: 00422F37

Part of subcall function 0040E4A8: GetProcAddress.KERNEL32(?,0B), ref: 0040E4D2

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042300A), ref: 00422F8A

Strings

.DEFAULT\Control Panel\International, xrefs: 00422F61
Control Panel\Desktop\ResourceLocale, xrefs: 00422F99
GetUserDefaultUILanguage, xrefs: 00422F2D
Locale, xrefs: 00422F79
kernel32.dll, xrefs: 00422F32

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: dff07c34f93b3e6c39e557406e904af098fa4b2a4b5bb26404aaa7a5872d83d8
Instruction ID: c5d1680bc85d9fc9140fa9d9073cf59edbb396945b13f7385cf79b6cc5318819
Opcode Fuzzy Hash: dff07c34f93b3e6c39e557406e904af098fa4b2a4b5bb26404aaa7a5872d83d8
Instruction Fuzzy Hash: 73217630B00228BBDB50EAA5DE42B9E77B8DB44304F91487BA500E3285DBBC9F01D72D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D554, Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0040D554(void* __eflags, intOrPtr _a4, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				long _v16;
				void* _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				struct HINSTANCE__** _v48;
				CHAR* _v52;
				void _v56;
				long _v60;
				_Unknown_base(*)()* _v64;
				struct HINSTANCE__* _v68;
				CHAR* _v72;
				signed int _v76;
				CHAR* _v80;
				intOrPtr* _v84;
				void* _v88;
				void _v92;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				long _t113;
				intOrPtr* _t119;
				void* _t124;
				void _t126;
				long _t128;
				struct HINSTANCE__* _t142;
				long _t166;
				signed int* _t190;
				_Unknown_base(*)()* _t191;
				void* _t194;
				intOrPtr _t196;

				_push(_a4);
				memcpy( &_v56, 0x4a9c40, 8 << 2);
				_pop(_t194);
				_v56 =  *0x4a9c40;
				_v52 = E0040DA04( *0x004A9C44);
				_v48 = E0040DA14( *0x004A9C48);
				_v44 = E0040DA24( *0x004A9C4C);
				_v40 = E0040DA34( *0x004A9C50);
				_v36 = E0040DA34( *0x004A9C54);
				_v32 = E0040DA34( *0x004A9C58);
				_v28 =  *0x004A9C5C;
				memcpy( &_v92, 0x4a9c60, 9 << 2);
				_t196 = _t194;
				_v88 = 0x4a9c60;
				_v84 = _a8;
				_v80 = _v52;
				if((_v56 & 0x00000001) == 0) {
					_t166 =  *0x4a9c84; // 0x0
					_v8 = _t166;
					_v8 =  &_v92;
					RaiseException(0xc06d0057, 0, 1,  &_v8);
					return 0;
				}
				_t104 = _a8 - _v44;
				_t142 =  *_v48;
				if(_t104 < 0) {
					_t104 = _t104 + 3;
				}
				_v12 = _t104 >> 2;
				_t106 = _v12;
				_t190 = (_t106 << 2) + _v40;
				_t108 = (_t106 & 0xffffff00 | (_t190[0] & 0x00000080) == 0x00000000) & 0x00000001;
				_v76 = _t108;
				if(_t108 == 0) {
					_v72 =  *_t190 & 0x0000ffff;
				} else {
					_v72 = E0040DA44( *_t190) + 2;
				}
				_t191 = 0;
				if( *0x4b0640 == 0) {
					L10:
					if(_t142 != 0) {
						L25:
						_v68 = _t142;
						if( *0x4b0640 != 0) {
							_t191 =  *0x4b0640(2,  &_v92);
						}
						if(_t191 != 0) {
							L36:
							if(_t191 == 0) {
								_v60 = GetLastError();
								if( *0x4b0644 != 0) {
									_t191 =  *0x4b0644(4,  &_v92);
								}
								if(_t191 == 0) {
									_t113 =  *0x4a9c8c; // 0x0
									_v24 = _t113;
									_v24 =  &_v92;
									RaiseException(0xc06d007f, 0, 1,  &_v24);
									_t191 = _v64;
								}
							}
							goto L41;
						} else {
							if( *((intOrPtr*)(_t196 + 0x14)) == 0 ||  *((intOrPtr*)(_t196 + 0x1c)) == 0) {
								L35:
								_t191 = GetProcAddress(_t142, _v72);
								goto L36;
							} else {
								_t119 =  *((intOrPtr*)(_t142 + 0x3c)) + _t142;
								if( *_t119 != 0x4550 ||  *((intOrPtr*)(_t119 + 8)) != _v28 || (( *(_t119 + 0x34) & 0xffffff00 |  *(_t119 + 0x34) == _t142) & 0x00000001) == 0) {
									goto L35;
								} else {
									_t191 =  *((intOrPtr*)(_v36 + _v12 * 4));
									if(_t191 == 0) {
										goto L35;
									}
									L41:
									 *_a8 = _t191;
									goto L42;
								}
							}
						}
					}
					if( *0x4b0640 != 0) {
						_t142 =  *0x4b0640(1,  &_v92);
					}
					if(_t142 == 0) {
						_t142 = LoadLibraryA(_v80);
					}
					if(_t142 != 0) {
						L20:
						if(_t142 == E0040CEDC(_v48, _t142)) {
							FreeLibrary(_t142);
						} else {
							if( *((intOrPtr*)(_t196 + 0x18)) != 0) {
								_t124 = LocalAlloc(0x40, 8);
								_v20 = _t124;
								if(_t124 != 0) {
									 *((intOrPtr*)(_v20 + 4)) = _t196;
									_t126 =  *0x4a9c3c; // 0x0
									 *_v20 = _t126;
									 *0x4a9c3c = _v20;
								}
							}
						}
						goto L25;
					} else {
						_v60 = GetLastError();
						if( *0x4b0644 != 0) {
							_t142 =  *0x4b0644(3,  &_v92);
						}
						if(_t142 != 0) {
							goto L20;
						} else {
							_t128 =  *0x4a9c88; // 0x0
							_v16 = _t128;
							_v16 =  &_v92;
							RaiseException(0xc06d007e, 0, 1,  &_v16);
							return _v64;
						}
					}
				} else {
					_t191 =  *0x4b0640(0,  &_v92);
					if(_t191 == 0) {
						goto L10;
					} else {
						L42:
						if( *0x4b0640 != 0) {
							_v60 = 0;
							_v68 = _t142;
							_v64 = _t191;
							 *0x4b0640(5,  &_v92);
						}
						return _t191;
					}
				}
			}

0x0040d568
0x0040d56e
0x0040d570
0x0040d573
0x0040d580
0x0040d58d
0x0040d59a
0x0040d5a7
0x0040d5b4
0x0040d5c1
0x0040d5ca
0x0040d5d8
0x0040d5da
0x0040d5db
0x0040d5e1
0x0040d5e7
0x0040d5ee
0x0040d5f0
0x0040d5f6
0x0040d5fc
0x0040d60c
0x00000000
0x0040d611
0x0040d61e
0x0040d623
0x0040d625
0x0040d627
0x0040d627
0x0040d62d
0x0040d630
0x0040d638
0x0040d642
0x0040d645
0x0040d64a
0x0040d665
0x0040d64c
0x0040d658
0x0040d658
0x0040d668
0x0040d671
0x0040d68a
0x0040d68c
0x0040d74e
0x0040d74e
0x0040d758
0x0040d766
0x0040d766
0x0040d76a
0x0040d7b7
0x0040d7b9
0x0040d7c0
0x0040d7ca
0x0040d7d8
0x0040d7d8
0x0040d7dc
0x0040d7de
0x0040d7e3
0x0040d7e9
0x0040d7f9
0x0040d7fe
0x0040d7fe
0x0040d7dc
0x00000000
0x0040d76c
0x0040d770
0x0040d7ab
0x0040d7b5
0x00000000
0x0040d778
0x0040d77b
0x0040d783
0x00000000
0x0040d79c
0x0040d7a2
0x0040d7a7
0x00000000
0x00000000
0x0040d801
0x0040d804
0x00000000
0x0040d804
0x0040d783
0x0040d770
0x0040d76a
0x0040d699
0x0040d6a7
0x0040d6a7
0x0040d6ab
0x0040d6b6
0x0040d6b6
0x0040d6ba
0x0040d707
0x0040d713
0x0040d749
0x0040d715
0x0040d719
0x0040d71f
0x0040d724
0x0040d729
0x0040d730
0x0040d736
0x0040d73b
0x0040d740
0x0040d740
0x0040d729
0x0040d719
0x00000000
0x0040d6bc
0x0040d6c1
0x0040d6cb
0x0040d6d9
0x0040d6d9
0x0040d6dd
0x00000000
0x0040d6df
0x0040d6df
0x0040d6e4
0x0040d6ea
0x0040d6fa
0x00000000
0x0040d6ff
0x0040d6dd
0x0040d673
0x0040d67f
0x0040d683
0x00000000
0x0040d685
0x0040d806
0x0040d80d
0x0040d811
0x0040d814
0x0040d817
0x0040d820
0x0040d820
0x00000000
0x0040d826
0x0040d683

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040D60C

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bb38534db3716b5c0e8cc02abb66565b7a6061d3ab8a69af711d2669e69f4069
Instruction ID: c0290ffb1106a5c61d4348b5596b834e5d82be19a22c5125b9ccd60b821c4e33
Opcode Fuzzy Hash: bb38534db3716b5c0e8cc02abb66565b7a6061d3ab8a69af711d2669e69f4069
Instruction Fuzzy Hash: 42A13F75E006099FDB14DFE8D885BAEB7B5BB88310F14813AE905B73C0D778A949CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041F8C0, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041F8C0(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _MEMORY_BASIC_INFORMATION _v36;
				short _v558;
				char _v564;
				intOrPtr _v568;
				char _v572;
				char _v576;
				char _v580;
				intOrPtr _v584;
				char _v588;
				void* _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				intOrPtr _v612;
				char _v616;
				char _v620;
				char _v624;
				void* _v628;
				char _v632;
				void* _t64;
				intOrPtr _t65;
				long _t76;
				intOrPtr _t82;
				intOrPtr _t103;
				intOrPtr _t107;
				intOrPtr _t110;
				intOrPtr _t112;
				intOrPtr _t115;
				intOrPtr _t127;
				void* _t136;
				intOrPtr _t138;
				void* _t141;
				void* _t143;

				_t136 = __edi;
				_t140 = _t141;
				_v632 = 0;
				_v596 = 0;
				_v604 = 0;
				_v600 = 0;
				_v8 = 0;
				_push(_t141);
				_push(0x41fac6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t141 + 0xfffffd8c;
				_t64 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x14)) - 1;
				_t143 = _t64;
				if(_t143 < 0) {
					_t65 =  *0x4ac798; // 0x40ea20
					E0040CD2C(_t65,  &_v8, _t140);
				} else {
					if(_t143 == 0) {
						_t107 =  *0x4ac670; // 0x40ea28
						E0040CD2C(_t107,  &_v8, _t140);
					} else {
						if(_t64 == 7) {
							_t110 =  *0x4ac4d0; // 0x40ea30
							E0040CD2C(_t110,  &_v8, _t140);
						} else {
							_t112 =  *0x4ac5c8; // 0x40ea38
							E0040CD2C(_t112,  &_v8, _t140);
						}
					}
				}
				_t115 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x18));
				VirtualQuery( *( *((intOrPtr*)(_a4 - 4)) + 0xc),  &_v36, 0x1c);
				_t138 = _v36.State;
				if(_t138 == 0x1000 || _t138 == 0x10000) {
					_t76 = GetModuleFileNameW(_v36.AllocationBase,  &_v558, 0x105);
					_t147 = _t76;
					if(_t76 == 0) {
						goto L12;
					} else {
						_v592 =  *( *((intOrPtr*)(_a4 - 4)) + 0xc);
						_v588 = 5;
						E0040856C( &_v600, 0x105,  &_v558);
						E0041A538(_v600, _t115,  &_v596, _t136, _t138, _t147);
						_v584 = _v596;
						_v580 = 0x11;
						_v576 = _v8;
						_v572 = 0x11;
						_v568 = _t115;
						_v564 = 5;
						_push( &_v592);
						_t103 =  *0x4ac6e0; // 0x40eb00
						E0040CD2C(_t103,  &_v604, _t140, 3);
						E0041F3C0(_t115, _v604, 1, _t136, _t138);
					}
				} else {
					L12:
					_v628 =  *( *((intOrPtr*)(_a4 - 4)) + 0xc);
					_v624 = 5;
					_v620 = _v8;
					_v616 = 0x11;
					_v612 = _t115;
					_v608 = 5;
					_push( &_v628);
					_t82 =  *0x4ac67c; // 0x40e9c8
					E0040CD2C(_t82,  &_v632, _t140, 2);
					E0041F3C0(_t115, _v632, 1, _t136, _t138);
				}
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(0x41facd);
				E004079F4( &_v632);
				E00407A54( &_v604, 3);
				return E004079F4( &_v8);
			}

0x0041f8c0
0x0041f8c1
0x0041f8cd
0x0041f8d3
0x0041f8d9
0x0041f8df
0x0041f8e5
0x0041f8ea
0x0041f8eb
0x0041f8f0
0x0041f8f3
0x0041f8ff
0x0041f8ff
0x0041f902
0x0041f910
0x0041f915
0x0041f904
0x0041f904
0x0041f91f
0x0041f924
0x0041f906
0x0041f909
0x0041f92e
0x0041f933
0x0041f90b
0x0041f93d
0x0041f942
0x0041f942
0x0041f909
0x0041f904
0x0041f94d
0x0041f960
0x0041f965
0x0041f96e
0x0041f98c
0x0041f991
0x0041f993
0x00000000
0x0041f999
0x0041f9a2
0x0041f9a8
0x0041f9c0
0x0041f9d1
0x0041f9dc
0x0041f9e2
0x0041f9ec
0x0041f9f2
0x0041f9f9
0x0041f9ff
0x0041fa0c
0x0041fa15
0x0041fa1a
0x0041fa2c
0x0041fa31
0x0041fa35
0x0041fa35
0x0041fa3e
0x0041fa44
0x0041fa4e
0x0041fa54
0x0041fa5b
0x0041fa61
0x0041fa6e
0x0041fa77
0x0041fa7c
0x0041fa8e
0x0041fa93
0x0041fa97
0x0041fa9a
0x0041fa9d
0x0041faa8
0x0041fab8
0x0041fac5

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041FAC6), ref: 0041F960
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,0041FAC6), ref: 0041F98C

Part of subcall function 0040CD2C: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040CD71

Strings

$eA, xrefs: 0041FA27, 0041FA89
(@, xrefs: 0041F91F
8@, xrefs: 0041F93D
@, xrefs: 0041F910
0@, xrefs: 0041F92E

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: @$$eA$(@$0@$8@
API String ID: 902310565-693499950
Opcode ID: 7e2933c987fcbf8755fa47fa3e752120357f595b88d160efd4e8fe01f8cc19a2
Instruction ID: 8907c0fdb59343008c76ceb90c3378100399d4465cadcd87230c2457523b253d
Opcode Fuzzy Hash: 7e2933c987fcbf8755fa47fa3e752120357f595b88d160efd4e8fe01f8cc19a2
Instruction Fuzzy Hash: 33510574A04659DFDB50EF68CD88BCDBBF4AB48304F0041E6A808A7351D778AE89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004047B0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004047B0(int __eax, void* __ecx, void* __edx) {
				long _v12;
				int _t4;
				long _t7;
				void* _t11;
				long _t12;
				void* _t13;
				long _t18;

				_t4 = __eax;
				_t24 = __edx;
				_t20 = __eax;
				if( *0x4ad058 == 0) {
					_push(0x2010);
					_push(__edx);
					_push(__eax);
					_push(0);
					L00403780();
				} else {
					_t7 = E00407EC4(__edx);
					WriteFile(GetStdHandle(0xfffffff4), _t24, _t7,  &_v12, 0);
					_t11 =  *0x4a9078; // 0x403920
					_t12 = E00407EC4(_t11);
					_t13 =  *0x4a9078; // 0x403920
					WriteFile(GetStdHandle(0xfffffff4), _t13, _t12,  &_v12, 0);
					_t18 = E00407EC4(_t20);
					_t4 = WriteFile(GetStdHandle(0xfffffff4), _t20, _t18,  &_v12, 0);
				}
				return _t4;
			}

0x004047b0
0x004047b3
0x004047b5
0x004047be
0x00404821
0x00404826
0x00404827
0x00404828
0x0040482a
0x004047c0
0x004047c9
0x004047d8
0x004047e4
0x004047e9
0x004047ef
0x004047fd
0x0040480b
0x0040481a
0x0040481a
0x00404832

APIs

GetStdHandle.KERNEL32(000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047D2
WriteFile.KERNEL32(00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047D8
GetStdHandle.KERNEL32(000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047F7
WriteFile.KERNEL32(00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047FD
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?), ref: 00404814
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000), ref: 0040481A

Strings

9@, xrefs: 004047E4, 004047EF

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandleWrite
String ID: 9@
API String ID: 3320372497-3209974744
Opcode ID: 4e270b9709a1e126671c3d07b356aced4a42befb1328ca478adcdb9b8427dfa1
Instruction ID: 039b6809bffddf7eb8364f6b1d7a8ef426dfe463875095ecbcfdc7d20cb8dc15
Opcode Fuzzy Hash: 4e270b9709a1e126671c3d07b356aced4a42befb1328ca478adcdb9b8427dfa1
Instruction Fuzzy Hash: F601FED25091503DE100F7668C85F971E8C8B0973EF10457F7618F31C1C5394D44827E

Uniqueness

Uniqueness Score: -1.00%

Function 0041F214, Relevance: 12.1, APIs: 8, Instructions: 97
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0041F214(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char* _v8;
				long _v12;
				short _v140;
				short _v2188;
				void* _t15;
				char* _t17;
				intOrPtr _t19;
				intOrPtr _t30;
				long _t48;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t61;
				void* _t64;

				_push(__ebx);
				_push(__esi);
				_v8 = 0;
				_push(_t64);
				_push(0x41f339);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t64 + 0xfffff778;
				_t61 = E0041F01C(_t15, __ebx,  &_v2188, __edx, __edi, __esi, 0x400);
				_t17 =  *0x4ac6c0; // 0x4ad058
				if( *_t17 == 0) {
					_t19 =  *0x4ac4f8; // 0x40ea00
					_t11 = _t19 + 4; // 0xffed
					LoadStringW(E0040A364( *0x4b0634),  *_t11,  &_v140, 0x40);
					MessageBoxW(0,  &_v2188,  &_v140, 0x2010);
				} else {
					_t30 =  *0x4ac524; // 0x4ad340
					E00405544(E00405800(_t30));
					_t48 = WideCharToMultiByte(1, 0,  &_v2188, _t61, 0, 0, 0, 0);
					_push(_t48);
					E00409F74();
					WideCharToMultiByte(1, 0,  &_v2188, _t61, _v8, _t48, 0, 0);
					WriteFile(GetStdHandle(0xfffffff4), _v8, _t48,  &_v12, 0);
					WriteFile(GetStdHandle(0xfffffff4), 0x41f354, 2,  &_v12, 0);
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x41f340);
				_t57 =  *0x41f1e4; // 0x41f1e8
				return E0040A098( &_v8, _t57);
			}

0x0041f21d
0x0041f21e
0x0041f221
0x0041f226
0x0041f227
0x0041f22c
0x0041f22f
0x0041f242
0x0041f244
0x0041f24c
0x0041f2ea
0x0041f2ef
0x0041f2fe
0x0041f318
0x0041f252
0x0041f252
0x0041f25c
0x0041f27a
0x0041f27c
0x0041f28b
0x0041f2a8
0x0041f2c0
0x0041f2da
0x0041f2da
0x0041f31f
0x0041f322
0x0041f325
0x0041f32d
0x0041f338

APIs

Part of subcall function 0041F01C: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041F1C8), ref: 0041F04F
Part of subcall function 0041F01C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041F073
Part of subcall function 0041F01C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041F08E
Part of subcall function 0041F01C: LoadStringW.USER32(00000000,0000FFEC,?,00000100), ref: 0041F129

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0041F339), ref: 0041F275
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F2A8
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F2BA
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F2C0
GetStdHandle.KERNEL32(000000F4,0041F354,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041F2D4
WriteFile.KERNEL32(00000000,000000F4,0041F354,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 0041F2DA
LoadStringW.USER32(00000000,0000FFED,?,00000040), ref: 0041F2FE
MessageBoxW.USER32(00000000,?,?,00002010), ref: 0041F318

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: 6de1fb4f568848f1ad312383e8938cc37fb5761b850aa9aff36d0b460632ffaf
Instruction ID: b395f61791e0df98aef8ec842badcc0ffa5cccf14742596207c1dbdfc5c66452
Opcode Fuzzy Hash: 6de1fb4f568848f1ad312383e8938cc37fb5761b850aa9aff36d0b460632ffaf
Instruction Fuzzy Hash: 58319371640208BEE714EB95DC83FEA73ACEB05704F904476BA04F71D1DA746E548B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404464, Relevance: 10.9, APIs: 7, Instructions: 406
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00404464(signed int __eax, intOrPtr __edx, void* __edi) {
				signed int __ebx;
				void* __esi;
				signed int _t69;
				signed int _t78;
				signed int _t93;
				long _t94;
				void* _t100;
				signed int _t102;
				signed int _t109;
				signed int _t115;
				signed int _t123;
				signed int _t129;
				void* _t131;
				signed int _t140;
				unsigned int _t148;
				signed int _t150;
				long _t152;
				signed int _t156;
				intOrPtr _t161;
				signed int _t166;
				signed int _t170;
				unsigned int _t171;
				intOrPtr _t174;
				intOrPtr _t192;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				void* _t205;
				unsigned int _t207;
				intOrPtr _t213;
				void* _t225;
				intOrPtr _t227;
				void* _t228;
				signed int _t230;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t238;
				signed int _t241;
				void* _t243;
				intOrPtr* _t244;

				_t176 = __edx;
				_t66 = __eax;
				_t166 =  *(__eax - 4);
				_t217 = __eax;
				if((_t166 & 0x00000007) != 0) {
					__eflags = _t166 & 0x00000005;
					if((_t166 & 0x00000005) != 0) {
						_pop(_t217);
						_pop(_t145);
						__eflags = _t166 & 0x00000003;
						if((_t166 & 0x00000003) == 0) {
							_push(_t145);
							_push(__eax);
							_push(__edi);
							_push(_t225);
							_t244 = _t243 + 0xffffffe0;
							_t218 = __edx;
							_t202 = __eax;
							_t69 =  *(__eax - 4);
							_t148 = (0xfffffff0 & _t69) - 0x14;
							if(0xfffffff0 >= __edx) {
								__eflags = __edx - _t148 >> 1;
								if(__edx < _t148 >> 1) {
									_t150 = E00403EE8(__edx);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t218 - 0x40a2c;
										if(_t218 > 0x40a2c) {
											_t78 = _t202 - 0x10;
											__eflags = _t78;
											 *((intOrPtr*)(_t78 + 8)) = _t218;
										}
										E00403AA4(_t202, _t218, _t150);
										E0040426C(_t202, _t202, _t225);
									}
								} else {
									_t150 = __eax;
									 *((intOrPtr*)(__eax - 0x10 + 8)) = __edx;
								}
							} else {
								if(0xfffffff0 <= __edx) {
									_t227 = __edx;
								} else {
									_t227 = 0xbadb9d;
								}
								 *_t244 = _t202 - 0x10 + (_t69 & 0xfffffff0);
								VirtualQuery( *(_t244 + 8), _t244 + 8, 0x1c);
								if( *((intOrPtr*)(_t244 + 0x14)) != 0x10000) {
									L12:
									_t150 = E00403EE8(_t227);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t227 - 0x40a2c;
										if(_t227 > 0x40a2c) {
											_t93 = _t150 - 0x10;
											__eflags = _t93;
											 *((intOrPtr*)(_t93 + 8)) = _t218;
										}
										E00403A74(_t202,  *((intOrPtr*)(_t202 - 0x10 + 8)), _t150);
										E0040426C(_t202, _t202, _t227);
									}
								} else {
									 *(_t244 + 0x10) =  *(_t244 + 0x10) & 0xffff0000;
									_t94 =  *(_t244 + 0x10);
									if(_t218 - _t148 >= _t94) {
										goto L12;
									} else {
										_t152 = _t227 - _t148 + 0x00010000 - 0x00000001 & 0xffff0000;
										if(_t94 < _t152) {
											_t152 = _t94;
										}
										if(VirtualAlloc( *(_t244 + 0xc), _t152, 0x2000, 4) == 0 || VirtualAlloc( *(_t244 + 0xc), _t152, 0x1000, 4) == 0) {
											goto L12;
										} else {
											_t100 = _t202 - 0x10;
											 *((intOrPtr*)(_t100 + 8)) = _t218;
											 *(_t100 + 0xc) = _t152 +  *(_t100 + 0xc) | 0x00000008;
											_t150 = _t202;
										}
									}
								}
							}
							return _t150;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t170 = _t166 & 0xfffffff0;
						_push(__edi);
						_t205 = _t170 + __eax;
						_t171 = _t170 - 4;
						_t156 = _t166 & 0x0000000f;
						__eflags = __edx - _t171;
						_push(_t225);
						if(__edx > _t171) {
							_t102 =  *(_t205 - 4);
							__eflags = _t102 & 0x00000001;
							if((_t102 & 0x00000001) == 0) {
								L75:
								asm("adc edi, 0xffffffff");
								_t228 = ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176;
								_t207 = _t171;
								_t109 = E00403EE8(((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176);
								_t192 = _t176;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L73;
								} else {
									__eflags = _t228 - 0x40a2c;
									if(_t228 > 0x40a2c) {
										 *((intOrPtr*)(_t109 - 8)) = _t192;
									}
									_t230 = _t109;
									E00403A74(_t217, _t207, _t109);
									E0040426C(_t217, _t207, _t230);
									return _t230;
								}
							} else {
								_t115 = _t102 & 0xfffffff0;
								_t232 = _t171 + _t115;
								__eflags = __edx - _t232;
								if(__edx > _t232) {
									goto L75;
								} else {
									__eflags =  *0x4ad059;
									if(__eflags == 0) {
										L66:
										__eflags = _t115 - 0xb30;
										if(_t115 >= 0xb30) {
											E00403AC0(_t205);
											_t176 = _t176;
											_t171 = _t171;
										}
										asm("adc edi, 0xffffffff");
										_t123 = (_t176 + ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + 0x000000d3 & 0xffffff00) + 0x30;
										_t195 = _t232 + 4 - _t123;
										__eflags = _t195;
										if(_t195 > 0) {
											 *(_t217 + _t232 - 4) = _t195;
											 *((intOrPtr*)(_t217 - 4 + _t123)) = _t195 + 3;
											_t233 = _t123;
											__eflags = _t195 - 0xb30;
											if(_t195 >= 0xb30) {
												__eflags = _t123 + _t217;
												E00403B00(_t123 + _t217, _t171, _t195);
											}
										} else {
											 *(_t217 + _t232) =  *(_t217 + _t232) & 0xfffffff7;
											_t233 = _t232 + 4;
										}
										_t234 = _t233 | _t156;
										__eflags = _t234;
										 *(_t217 - 4) = _t234;
										 *0x4adae8 = 0;
										_t109 = _t217;
										L73:
										return _t109;
									} else {
										while(1) {
											asm("lock cmpxchg [0x4adae8], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x4ad989;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t176 = _t176;
												_t171 = _t171;
												asm("lock cmpxchg [0x4adae8], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t176 = _t176;
													_t171 = _t171;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										_t129 =  *(_t205 - 4);
										__eflags = _t129 & 0x00000001;
										if((_t129 & 0x00000001) == 0) {
											L74:
											 *0x4adae8 = 0;
											goto L75;
										} else {
											_t115 = _t129 & 0xfffffff0;
											_t232 = _t171 + _t115;
											__eflags = _t176 - _t232;
											if(_t176 > _t232) {
												goto L74;
											} else {
												goto L66;
											}
										}
									}
								}
							}
						} else {
							__eflags = __edx + __edx - _t171;
							if(__edx + __edx < _t171) {
								__eflags = __edx - 0xb2c;
								if(__edx >= 0xb2c) {
									L41:
									_t32 = _t176 + 0xd3; // 0xbff
									_t238 = (_t32 & 0xffffff00) + 0x30;
									_t174 = _t171 + 4 - _t238;
									__eflags =  *0x4ad059;
									if(__eflags != 0) {
										while(1) {
											asm("lock cmpxchg [0x4adae8], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x4ad989;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t174 = _t174;
												asm("lock cmpxchg [0x4adae8], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t174 = _t174;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										__eflags = 0xf;
									}
									 *(_t217 - 4) = _t156 | _t238;
									_t161 = _t174;
									_t196 =  *(_t205 - 4);
									__eflags = _t196 & 0x00000001;
									if((_t196 & 0x00000001) != 0) {
										_t131 = _t205;
										_t197 = _t196 & 0xfffffff0;
										_t161 = _t161 + _t197;
										_t205 = _t205 + _t197;
										__eflags = _t197 - 0xb30;
										if(_t197 >= 0xb30) {
											E00403AC0(_t131);
										}
									} else {
										 *(_t205 - 4) = _t196 | 0x00000008;
									}
									 *((intOrPtr*)(_t205 - 8)) = _t161;
									 *((intOrPtr*)(_t217 + _t238 - 4)) = _t161 + 3;
									__eflags = _t161 - 0xb30;
									if(_t161 >= 0xb30) {
										E00403B00(_t217 + _t238, _t174, _t161);
									}
									 *0x4adae8 = 0;
									return _t217;
								} else {
									__eflags = __edx - 0x2cc;
									if(__edx < 0x2cc) {
										_t213 = __edx;
										_t140 = E00403EE8(__edx);
										__eflags = _t140;
										if(_t140 != 0) {
											_t241 = _t140;
											E00403AA4(_t217, _t213, _t140);
											E0040426C(_t217, _t213, _t241);
											_t140 = _t241;
										}
										return _t140;
									} else {
										_t176 = 0xb2c;
										__eflags = _t171 - 0xb2c;
										if(_t171 <= 0xb2c) {
											goto L37;
										} else {
											goto L41;
										}
									}
								}
							} else {
								L37:
								return _t66;
							}
						}
					}
				} else {
					__ebx =  *__ecx;
					__ecx =  *(__ebx + 2) & 0x0000ffff;
					__ecx = ( *(__ebx + 2) & 0x0000ffff) - 4;
					__eflags = __ecx - __edx;
					if(__ecx < __edx) {
						__ecx = __ecx + __ecx + 0x20;
						_push(__edi);
						__edi = __edx;
						__eax = 0;
						__ecx = __ecx - __edx;
						asm("adc eax, 0xffffffff");
						__eax = 0 & __ecx;
						__eax = (0 & __ecx) + __edx;
						__eax = E00403EE8((0 & __ecx) + __edx);
						__eflags = __eax;
						if(__eax != 0) {
							__eflags = __edi - 0x40a2c;
							if(__edi > 0x40a2c) {
								 *(__eax - 8) = __edi;
							}
							 *(__ebx + 2) & 0x0000ffff = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__eflags = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__edx = __eax;
							__edi = __eax;
							 *((intOrPtr*)(__ebx + 0x1c))() = E0040426C(__esi, __edi, __ebp);
							__eax = __edi;
						}
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						return __eax;
					} else {
						__ebx = 0x40 + __edx * 4;
						__eflags = 0x40 + __edx * 4 - __ecx;
						if(0x40 + __edx * 4 < __ecx) {
							__ebx = __edx;
							__eax = __edx;
							__eax = E00403EE8(__edx);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = __ebx;
								__edx = __eax;
								__ebx = __eax;
								__esi = E0040426C(__esi, __edi, __ebp);
								__eax = __ebx;
							}
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x00404464
0x00404464
0x00404464
0x0040446c
0x0040446e
0x004044fc
0x004044ff
0x0040476c
0x0040476d
0x0040476e
0x00404771
0x00403d9c
0x00403d9d
0x00403d9e
0x00403d9f
0x00403da0
0x00403da3
0x00403da5
0x00403dac
0x00403db5
0x00403dba
0x00403ea1
0x00403ea3
0x00403eb6
0x00403eb8
0x00403eba
0x00403ebc
0x00403ec2
0x00403ec6
0x00403ec6
0x00403ec9
0x00403ec9
0x00403ed2
0x00403ed9
0x00403ed9
0x00403ea5
0x00403ea5
0x00403eaa
0x00403eaa
0x00403dc0
0x00403dc9
0x00403dcf
0x00403dcb
0x00403dcb
0x00403dcb
0x00403ddb
0x00403dea
0x00403df7
0x00403e67
0x00403e6e
0x00403e70
0x00403e72
0x00403e74
0x00403e7a
0x00403e7e
0x00403e7e
0x00403e81
0x00403e81
0x00403e91
0x00403e98
0x00403e98
0x00403df9
0x00403df9
0x00403e05
0x00403e0b
0x00000000
0x00403e0d
0x00403e1e
0x00403e22
0x00403e24
0x00403e24
0x00403e3a
0x00000000
0x00403e52
0x00403e54
0x00403e57
0x00403e60
0x00403e63
0x00403e63
0x00403e3a
0x00403e0b
0x00403df7
0x00403ee7
0x00404777
0x00404777
0x00404779
0x00404779
0x00404505
0x00404507
0x0040450a
0x0040450b
0x0040450e
0x00404511
0x00404514
0x00404516
0x00404517
0x0040462c
0x0040462f
0x00404631
0x00404724
0x0040472f
0x00404736
0x00404738
0x0040473b
0x00404740
0x00404741
0x00404743
0x00000000
0x00404745
0x00404745
0x0040474b
0x0040474d
0x0040474d
0x00404750
0x00404758
0x0040475f
0x0040476a
0x0040476a
0x00404637
0x00404637
0x0040463a
0x0040463d
0x0040463f
0x00000000
0x00404645
0x00404645
0x0040464c
0x004046a9
0x004046a9
0x004046ae
0x004046b4
0x004046b9
0x004046ba
0x004046ba
0x004046c6
0x004046d7
0x004046dd
0x004046dd
0x004046df
0x004046ec
0x004046f3
0x004046f7
0x004046f9
0x004046ff
0x00404701
0x00404703
0x00404703
0x004046e1
0x004046e1
0x004046e5
0x004046e5
0x00404708
0x00404708
0x0040470a
0x0040470d
0x00404714
0x00404716
0x0040471a
0x0040464e
0x0040464e
0x00404653
0x0040465b
0x00000000
0x00000000
0x0040465d
0x0040465f
0x00404666
0x00000000
0x00404668
0x0040466c
0x00404671
0x00404672
0x00404678
0x00404680
0x00404686
0x0040468b
0x0040468c
0x00000000
0x0040468c
0x00404680
0x00000000
0x00404666
0x00404695
0x00404698
0x0040469b
0x0040469d
0x0040471d
0x0040471d
0x00000000
0x0040469f
0x0040469f
0x004046a2
0x004046a5
0x004046a7
0x00000000
0x00000000
0x00000000
0x00000000
0x004046a7
0x0040469d
0x0040464c
0x0040463f
0x0040451d
0x00404520
0x00404522
0x0040452c
0x00404532
0x00404549
0x00404549
0x00404555
0x0040455b
0x0040455d
0x00404564
0x00404566
0x0040456b
0x00404573
0x00000000
0x00000000
0x00404575
0x00404577
0x0040457e
0x00000000
0x00404580
0x00404583
0x00404588
0x0040458e
0x00404596
0x0040459b
0x004045a0
0x00000000
0x004045a0
0x00404596
0x00000000
0x0040457e
0x004045a9
0x004045a9
0x004045a9
0x004045ae
0x004045b1
0x004045b3
0x004045b6
0x004045b9
0x004045c4
0x004045c6
0x004045c9
0x004045cb
0x004045cd
0x004045d3
0x004045d5
0x004045d5
0x004045bb
0x004045be
0x004045be
0x004045da
0x004045e0
0x004045e4
0x004045ea
0x004045f1
0x004045f1
0x004045f6
0x00404603
0x00404534
0x00404534
0x0040453a
0x00404604
0x00404608
0x0040460d
0x0040460f
0x00404611
0x00404619
0x00404620
0x00404625
0x00404625
0x0040462b
0x00404540
0x00404540
0x00404545
0x00404547
0x00000000
0x00000000
0x00000000
0x00000000
0x00404547
0x0040453a
0x00404524
0x00404524
0x00404528
0x00404528
0x00404522
0x00404517
0x00404474
0x00404474
0x00404476
0x0040447a
0x0040447d
0x0040447f
0x004044b8
0x004044bc
0x004044bd
0x004044bf
0x004044c1
0x004044c3
0x004044c6
0x004044c8
0x004044ca
0x004044cf
0x004044d1
0x004044d3
0x004044d9
0x004044db
0x004044db
0x004044e2
0x004044e2
0x004044e5
0x004044e7
0x004044f0
0x004044f5
0x004044f5
0x004044f7
0x004044f8
0x004044f9
0x004044fa
0x00404481
0x00404481
0x00404488
0x0040448a
0x00404490
0x00404492
0x00404494
0x00404499
0x0040449b
0x0040449d
0x0040449f
0x004044a1
0x004044ac
0x004044b1
0x004044b1
0x004044b3
0x004044b4
0x004044b5
0x0040448c
0x0040448c
0x0040448d
0x0040448e
0x0040448e
0x0040448a
0x0040447f

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5439aca8df4603b27f37f25116b021730c29e514c4b4e173baf39aeb11cdd27a
Instruction ID: 0a757bcfe66f4df8a837bb95f72d8b736428374affe9d1eaec42a64222243fb9
Opcode Fuzzy Hash: 5439aca8df4603b27f37f25116b021730c29e514c4b4e173baf39aeb11cdd27a
Instruction Fuzzy Hash: 83C115A27106000BD714AE7DDD8476ABA8A9BC5716F18827FF244EB3D6DA7CCD418348

Uniqueness

Uniqueness Score: -1.00%

Function 0040665C, Relevance: 10.6, APIs: 7, Instructions: 130
threadCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040665C(signed char* __eax, void* __edx, void* __eflags) {
				void* _t49;
				signed char _t56;
				intOrPtr _t57;
				signed char _t59;
				void* _t70;
				signed char* _t71;
				intOrPtr _t72;
				signed char* _t73;

				_t70 = __edx;
				_t71 = __eax;
				_t72 =  *((intOrPtr*)(__eax + 0x10));
				while(1) {
					L1:
					 *_t73 = E00406B04(_t71);
					if( *_t73 != 0 || _t70 == 0) {
						break;
					}
					_t73[1] = 0;
					if(_t72 <= 0) {
						while(1) {
							L17:
							_t56 =  *_t71;
							if(_t56 == 0) {
								goto L1;
							}
							asm("lock cmpxchg [esi], edx");
							if(_t56 != _t56) {
								continue;
							} else {
								goto L19;
							}
							do {
								L19:
								_t73[4] = GetTickCount();
								E00406860(_t71);
								_t57 =  *0x4ad8f8; // 0x4ab284
								 *((intOrPtr*)(_t57 + 0x10))();
								 *_t73 = 0 == 0;
								if(_t70 != 0xffffffff) {
									_t73[8] = GetTickCount();
									if(_t70 <= _t73[8] - _t73[4]) {
										_t70 = 0;
									} else {
										_t70 = _t70 - _t73[8] - _t73[4];
									}
								}
								if( *_t73 == 0) {
									do {
										asm("lock cmpxchg [esi], edx");
									} while ( *_t71 !=  *_t71);
									_t73[1] = 1;
								} else {
									while(1) {
										_t59 =  *_t71;
										if((_t59 & 0x00000001) != 0) {
											goto L29;
										}
										asm("lock cmpxchg [esi], edx");
										if(_t59 != _t59) {
											continue;
										}
										_t73[1] = 1;
										goto L29;
									}
								}
								L29:
							} while (_t73[1] == 0);
							if( *_t73 != 0) {
								_t71[8] = GetCurrentThreadId();
								_t71[4] = 1;
							}
							goto L32;
						}
						continue;
					}
					_t73[4] = GetTickCount();
					_t73[0xc] = 0;
					if(_t72 <= 0) {
						L13:
						if(_t70 == 0xffffffff) {
							goto L17;
						}
						_t73[8] = GetTickCount();
						_t49 = _t73[8] - _t73[4];
						if(_t70 > _t49) {
							_t70 = _t70 - _t49;
							goto L17;
						}
						 *_t73 = 0;
						break;
					}
					L5:
					L5:
					if(_t70 == 0xffffffff || _t70 > GetTickCount() - _t73[4]) {
						goto L8;
					} else {
						 *_t73 = 0;
					}
					break;
					L8:
					if( *_t71 > 1) {
						goto L13;
					}
					if( *_t71 != 0) {
						L12:
						E0040633C( &(_t73[0xc]));
						_t72 = _t72 - 1;
						if(_t72 > 0) {
							goto L5;
						}
						goto L13;
					}
					asm("lock cmpxchg [esi], edx");
					if(0 != 0) {
						goto L12;
					}
					_t71[8] = GetCurrentThreadId();
					_t71[4] = 1;
					 *_t73 = 1;
					break;
				}
				L32:
				return  *_t73 & 0x000000ff;
			}

0x00406663
0x00406665
0x00406667
0x0040666a
0x0040666a
0x00406671
0x00406678
0x00000000
0x00000000
0x00406686
0x0040668d
0x00406725
0x00406725
0x00406725
0x00406729
0x00000000
0x00000000
0x00406734
0x0040673a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406741
0x00406747
0x0040674e
0x00406758
0x0040675d
0x00406764
0x0040676b
0x00406779
0x00406787
0x0040677b
0x00406783
0x00406783
0x00406779
0x0040678d
0x004067af
0x004067b8
0x004067bc
0x004067c0
0x00000000
0x0040678f
0x0040678f
0x00406794
0x00000000
0x00000000
0x004067a0
0x004067a6
0x00000000
0x00000000
0x004067a8
0x00000000
0x004067a8
0x0040678f
0x004067c5
0x004067c5
0x004067d4
0x004067db
0x004067de
0x004067de
0x00000000
0x004067d4
0x00000000
0x00406725
0x00406698
0x0040669e
0x004066a4
0x00406700
0x00406703
0x00000000
0x00000000
0x0040670a
0x00406712
0x00406718
0x00406723
0x00000000
0x00406723
0x0040671a
0x00000000
0x0040671a
0x00000000
0x004066a6
0x004066a9
0x00000000
0x004066b8
0x004066b8
0x004066b8
0x00000000
0x004066c1
0x004066c4
0x00000000
0x00000000
0x004066c9
0x004066f2
0x004066f6
0x004066fb
0x004066fe
0x00000000
0x00000000
0x00000000
0x004066fe
0x004066d2
0x004066d8
0x00000000
0x00000000
0x004066df
0x004066e2
0x004066e9
0x00000000
0x004066e9
0x004067e5
0x004067f0

APIs

Part of subcall function 00406B04: GetCurrentThreadId.KERNEL32 ref: 00406B07

GetTickCount.KERNEL32 ref: 00406693
GetTickCount.KERNEL32 ref: 004066AB
GetCurrentThreadId.KERNEL32 ref: 004066DA
GetTickCount.KERNEL32 ref: 00406705
GetTickCount.KERNEL32 ref: 0040673C
GetTickCount.KERNEL32 ref: 00406766
GetCurrentThreadId.KERNEL32 ref: 004067D6

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 72bf5cf191fff23eea650aef81e54304f71ab1849b51d2c2f8be95d33ba0f9a3
Instruction ID: d55af3395c34765ca91144e68d0792783d215dccc41bd3b69e0d2f57a8242420
Opcode Fuzzy Hash: 72bf5cf191fff23eea650aef81e54304f71ab1849b51d2c2f8be95d33ba0f9a3
Instruction Fuzzy Hash: C441A0712083418EE721AF7CC44432BBAD5AF84358F16893EE4DA973C1EB7DC8948756

Uniqueness

Uniqueness Score: -1.00%

Function 004063F8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E004063F8(void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char* _t23;
				intOrPtr _t29;
				intOrPtr _t39;
				void* _t41;
				void* _t43;
				intOrPtr _t44;

				_t41 = _t43;
				_t44 = _t43 + 0xfffffff4;
				_v16 = 0;
				if(GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformation") == 0) {
					L10:
					_v8 = 0x40;
					goto L11;
				} else {
					_t23 =  &_v16;
					_push(_t23);
					_push(0);
					L00403808();
					if(_t23 != 0 || GetLastError() != 0x7a) {
						goto L10;
					} else {
						_v12 = E004053F0(_v16);
						_push(_t41);
						_push(E004064A6);
						_push( *[fs:edx]);
						 *[fs:edx] = _t44;
						_push( &_v16);
						_push(_v12);
						L00403808();
						_t29 = _v12;
						if(_v16 <= 0) {
							L8:
							_pop(_t39);
							 *[fs:eax] = _t39;
							_push(E004064AD);
							return E0040540C(_v12);
						} else {
							while( *((short*)(_t29 + 4)) != 2 ||  *((char*)(_t29 + 8)) != 1) {
								_t29 = _t29 + 0x18;
								_v16 = _v16 - 0x18;
								if(_v16 > 0) {
									continue;
								} else {
									goto L8;
								}
								goto L12;
							}
							_v8 =  *(_t29 + 0xa) & 0x0000ffff;
							E004071E4();
							L11:
							return _v8;
						}
					}
				}
				L12:
			}

0x004063f9
0x004063fb
0x00406400
0x0040641a
0x004064ad
0x004064ad
0x00000000
0x00406420
0x00406420
0x00406423
0x00406424
0x00406426
0x0040642d
0x00000000
0x00406439
0x00406441
0x00406446
0x00406447
0x0040644c
0x0040644f
0x00406455
0x00406459
0x0040645a
0x0040645f
0x00406466
0x00406490
0x00406492
0x00406495
0x00406498
0x004064a5
0x00406468
0x00406468
0x00406483
0x00406486
0x0040648e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040648e
0x00406479
0x0040647c
0x004064b4
0x004064ba
0x004064ba
0x00406466
0x0040642d
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 0040640D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406413
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 0040642F

Strings

GetLogicalProcessorInformation, xrefs: 00406403
kernel32.dll, xrefs: 00406408
@, xrefs: 004064AD

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-79381301
Opcode ID: 9a328c14a2360e788c5d7c27423bd1e3d2ec7813e67ce0fbf63762a3592cbdfc
Instruction ID: 0ade09f5ec255af418c15bc26d56a5e77a61777008c3a3a20ffec8f8ea5cdbb2
Opcode Fuzzy Hash: 9a328c14a2360e788c5d7c27423bd1e3d2ec7813e67ce0fbf63762a3592cbdfc
Instruction Fuzzy Hash: 5E115E71D00204BEDB20EFA5D845B6EBBB8DB40715F1180BBF815B36C2D67D9A908A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040768C, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E0040768C(void* __ecx) {
				long _v4;
				void* _t3;
				void* _t9;

				if( *0x4ad058 == 0) {
					if( *0x4a9032 == 0) {
						_push(0);
						_push("Error");
						_push("Runtime error     at 00000000");
						_push(0);
						L00403780();
					}
					return _t3;
				} else {
					if( *0x4ad344 == 0xd7b2 &&  *0x4ad34c > 0) {
						 *0x4ad35c();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					_t9 = E004081CC(0x407720);
					return WriteFile(GetStdHandle(0xfffffff5), _t9, 2,  &_v4, 0);
				}
			}

0x00407694
0x004076fa
0x004076fc
0x004076fe
0x00407703
0x00407708
0x0040770a
0x0040770a
0x00407710
0x00407696
0x0040769f
0x004076af
0x004076af
0x004076cb
0x004076de
0x004076f2
0x004076f2

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?,0040785E,004054DF,00405526,?,?,0040553F), ref: 004076C5
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?,0040785E,004054DF,00405526,?,?), ref: 004076CB
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?,?), ref: 004076E6
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407744,?,?), ref: 004076EC

Strings

Runtime error at 00000000, xrefs: 004076BE, 00407703
Error, xrefs: 004076FE

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: bcadf97d171622b971a48ef55ce44254769ff37e7ce13582472eefcd77e0394f
Instruction ID: 8e7c00c9dcfef4ecea202c25e54e487df448fc8b33d2ce18683e8ba9e0f24e41
Opcode Fuzzy Hash: bcadf97d171622b971a48ef55ce44254769ff37e7ce13582472eefcd77e0394f
Instruction Fuzzy Hash: 8DF0C2E1E8820078EA207BA54C86F5B2A5C4752B2AF10493FF621B56C2C6BD5884872F

Uniqueness

Uniqueness Score: -1.00%

Function 00429208, Relevance: 9.1, APIs: 6, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00429208(short* __eax, intOrPtr __ecx, signed short* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				signed short* _v808;
				void* __ebp;
				signed char _t55;
				signed int _t64;
				void* _t72;
				intOrPtr* _t83;
				void* _t103;
				void* _t105;
				void* _t108;
				void* _t109;
				intOrPtr* _t118;
				void* _t122;
				intOrPtr _t123;
				char* _t124;
				void* _t125;

				_t110 = __ecx;
				_v780 = __ecx;
				_v808 = __edx;
				_v776 = __eax;
				if((_v808[0] & 0x00000020) == 0) {
					E00428EC8(0x80070057);
				}
				_t55 =  *_v808 & 0x0000ffff;
				if((_t55 & 0x00000fff) != 0xc) {
					_push(_v808);
					_push(_v776);
					L00427140();
					return E00428EC8(_v776);
				} else {
					if((_t55 & 0x00000040) == 0) {
						_v792 = _v808[4];
					} else {
						_v792 =  *(_v808[4]);
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t103 = _v788 - 1;
					if(_t103 < 0) {
						L9:
						_push( &_v772);
						_t64 = _v788;
						_push(_t64);
						_push(0xc);
						L00427714();
						_t123 = _t64;
						if(_t123 == 0) {
							E00428C20(_t110);
						}
						E00429164(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t123;
						_t105 = _v788 - 1;
						if(_t105 < 0) {
							L14:
							_t107 = _v788 - 1;
							if(E00429180(_v788 - 1, _t125) != 0) {
								L0042772C();
								E00428EC8(_v792);
								L0042772C();
								E00428EC8( &_v260);
								_v780(_t123,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t72 = E004291B0(_t107, _t125);
						} else {
							_t108 = _t105 + 1;
							_t83 =  &_v768;
							_t118 =  &_v260;
							do {
								 *_t118 =  *_t83;
								_t118 = _t118 + 4;
								_t83 = _t83 + 8;
								_t108 = _t108 - 1;
							} while (_t108 != 0);
							do {
								goto L14;
							} while (_t72 != 0);
							return _t72;
						}
					} else {
						_t109 = _t103 + 1;
						_t122 = 0;
						_t124 =  &_v772;
						do {
							_v804 = _t124;
							_push(_v804 + 4);
							_t23 = _t122 + 1; // 0x1
							_push(_v792);
							L0042771C();
							E00428EC8(_v792);
							_push( &_v784);
							_t26 = _t122 + 1; // 0x1
							_push(_v792);
							L00427724();
							E00428EC8(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t122 = _t122 + 1;
							_t124 = _t124 + 8;
							_t109 = _t109 - 1;
						} while (_t109 != 0);
						goto L9;
					}
				}
			}

0x00429208
0x00429214
0x0042921a
0x00429220
0x00429230
0x00429237
0x00429237
0x00429242
0x00429250
0x004293db
0x004293e2
0x004293e3
0x00000000
0x00429256
0x00429259
0x00429277
0x0042925b
0x00429266
0x00429266
0x00429286
0x00429292
0x00429295
0x00429302
0x00429308
0x00429309
0x0042930f
0x00429310
0x00429312
0x00429317
0x0042931b
0x0042931d
0x0042931d
0x00429328
0x00429333
0x0042933e
0x00429347
0x0042934a
0x00429366
0x0042936d
0x00429378
0x0042938f
0x00429394
0x004293a8
0x004293ad
0x004293c0
0x004293c0
0x004293c9
0x0042934c
0x0042934c
0x0042934d
0x00429353
0x00429359
0x0042935b
0x0042935d
0x00429360
0x00429363
0x00429363
0x00429366
0x00000000
0x00000000
0x00000000
0x00429366
0x00429297
0x00429297
0x00429298
0x0042929a
0x004292a0
0x004292a2
0x004292b1
0x004292b2
0x004292bc
0x004292bd
0x004292c2
0x004292cd
0x004292ce
0x004292d8
0x004292d9
0x004292de
0x004292f9
0x004292fb
0x004292fc
0x004292ff
0x004292ff
0x00000000
0x004292a0
0x00429295

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004292BD
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004292D9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00429312
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0042938F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004293A8
VariantCopy.OLEAUT32(?,?), ref: 004293E3

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 2794ac47a9dfeb26b88a03ac4d1a853a299fb3d03b0a8c1988b6f7382be60e0b
Instruction ID: ed5b5572db2c6aea52d03e12d037d8ed927b089f3383118c81215fa9c213cc81
Opcode Fuzzy Hash: 2794ac47a9dfeb26b88a03ac4d1a853a299fb3d03b0a8c1988b6f7382be60e0b
Instruction Fuzzy Hash: CC51DA75A012399BCB22DB59DD81BD9B3FCAF4C304F8041DAE508E7251DA34AF818F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041F01C, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0041F01C(intOrPtr* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v534;
				short _v1056;
				short _v1568;
				struct _MEMORY_BASIC_INFORMATION _v1596;
				char _v1600;
				intOrPtr _v1604;
				char _v1608;
				intOrPtr _v1612;
				char _v1616;
				intOrPtr _v1620;
				char _v1624;
				char* _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				intOrPtr _t55;
				signed int _t76;
				void* _t82;
				intOrPtr _t83;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				void* _t105;

				_v1640 = 0;
				_v8 = __ecx;
				_t82 = __edx;
				_t102 = __eax;
				_push(_t105);
				_push(0x41f1c8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t105 + 0xfffff99c;
				VirtualQuery(__edx,  &_v1596, 0x1c);
				if(_v1596.State != 0x1000 || GetModuleFileNameW(_v1596.AllocationBase,  &_v1056, 0x105) == 0) {
					GetModuleFileNameW( *0x4b0634,  &_v1056, 0x105);
					_v12 = E0041F010(_t82);
				} else {
					_v12 = _t82 - _v1596.AllocationBase;
				}
				E0041A69C( &_v534, 0x104, E004204FC() + 2);
				_t83 = 0x41f1dc;
				_t100 = 0x41f1dc;
				_t95 =  *0x414ecc; // 0x414f24
				if(E00405F48(_t102, _t95) != 0) {
					_t83 = E004084C8( *((intOrPtr*)(_t102 + 4)));
					_t76 = E00407ED8(_t83);
					if(_t76 != 0 &&  *((short*)(_t83 + _t76 * 2 - 2)) != 0x2e) {
						_t100 = 0x41f1e0;
					}
				}
				_t55 =  *0x4ac774; // 0x40e9f8
				_t18 = _t55 + 4; // 0xffec
				LoadStringW(E0040A364( *0x4b0634),  *_t18,  &_v1568, 0x100);
				E00405BC8( *_t102,  &_v1640);
				_v1636 = _v1640;
				_v1632 = 0x11;
				_v1628 =  &_v534;
				_v1624 = 0xa;
				_v1620 = _v12;
				_v1616 = 5;
				_v1612 = _t83;
				_v1608 = 0xa;
				_v1604 = _t100;
				_v1600 = 0xa;
				E0041A934(4,  &_v1636);
				E00407ED8(_v8);
				_pop(_t98);
				 *[fs:eax] = _t98;
				_push(0x41f1cf);
				return E004079F4( &_v1640);
			}

0x0041f02a
0x0041f030
0x0041f033
0x0041f035
0x0041f039
0x0041f03a
0x0041f03f
0x0041f042
0x0041f04f
0x0041f05e
0x0041f08e
0x0041f09a
0x0041f09f
0x0041f0a5
0x0041f0a5
0x0041f0c7
0x0041f0cc
0x0041f0d1
0x0041f0d8
0x0041f0e5
0x0041f0ef
0x0041f0f3
0x0041f0fa
0x0041f104
0x0041f104
0x0041f0fa
0x0041f115
0x0041f11a
0x0041f129
0x0041f136
0x0041f141
0x0041f147
0x0041f154
0x0041f15a
0x0041f164
0x0041f16a
0x0041f171
0x0041f177
0x0041f17e
0x0041f184
0x0041f1a0
0x0041f1a8
0x0041f1b1
0x0041f1b4
0x0041f1b7
0x0041f1c7

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041F1C8), ref: 0041F04F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041F073
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041F08E
LoadStringW.USER32(00000000,0000FFEC,?,00000100), ref: 0041F129

Strings

$OA, xrefs: 0041F0D8

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: $OA
API String ID: 3990497365-3057587682
Opcode ID: a96d2beb162df43ddadfc5db31274654c9e37a74e946f5556500ab8d9869eb07
Instruction ID: d6d88cd0fe853d51226c3c26c9cb5cf48511ec36f022bd765e41d06481bb46b4
Opcode Fuzzy Hash: a96d2beb162df43ddadfc5db31274654c9e37a74e946f5556500ab8d9869eb07
Instruction Fuzzy Hash: 92412170A002189FDB20DF69CD81BCABBF9AB59304F4044FAE508E7241D7799E95CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00491188, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87
threadCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00491188(void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				void* _t23;
				char _t29;
				void* _t50;
				intOrPtr _t55;
				char _t57;
				intOrPtr _t59;
				void* _t64;
				void* _t66;
				void* _t68;
				void* _t69;
				intOrPtr _t70;

				_t64 = __edi;
				_t57 = __edx;
				_t50 = __ecx;
				_t68 = _t69;
				_t70 = _t69 + 0xfffffff0;
				_v20 = 0;
				if(__edx != 0) {
					_t70 = _t70 + 0xfffffff0;
					_t23 = E00406284(_t23, _t68);
				}
				_t49 = _t50;
				_v5 = _t57;
				_t66 = _t23;
				_push(_t68);
				_push(0x491281);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70;
				E00405C98(0);
				_t3 = _t66 + 0x2c; // 0x266461
				 *(_t66 + 0xf) =  *_t3 & 0x000000ff ^ 0x00000001;
				if(_t50 == 0 ||  *(_t66 + 0x2c) != 0) {
					_t29 = 0;
				} else {
					_t29 = 1;
				}
				 *((char*)(_t66 + 0xd)) = _t29;
				if( *(_t66 + 0x2c) != 0) {
					 *((intOrPtr*)(_t66 + 8)) = GetCurrentThread();
					 *((intOrPtr*)(_t66 + 4)) = GetCurrentThreadId();
				} else {
					if(_a4 == 0) {
						_t12 = _t66 + 4; // 0x48f524
						 *((intOrPtr*)(_t66 + 8)) = E004078B4(0, E00491094, 0, _t12, 4, _t66);
					} else {
						_t9 = _t66 + 4; // 0x48f524
						 *((intOrPtr*)(_t66 + 8)) = E004078B4(0, E00491094, _a4, _t9, 0x10004, _t66);
					}
					if( *((intOrPtr*)(_t66 + 8)) == 0) {
						E0041E0D0(GetLastError(), _t49, 0, _t66);
						_v16 = _v20;
						_v12 = 0x11;
						_t55 =  *0x4ac740; // 0x40ed5c
						E0041F47C(_t49, _t55, 1, _t64, _t66, 0,  &_v16);
						E004070F0();
					}
				}
				_pop(_t59);
				 *[fs:eax] = _t59;
				_push(0x491288);
				return E004079F4( &_v20);
			}

0x00491188
0x00491188
0x00491188
0x00491189
0x0049118b
0x00491192
0x00491197
0x00491199
0x0049119c
0x0049119c
0x004911a1
0x004911a3
0x004911a6
0x004911aa
0x004911ab
0x004911b0
0x004911b3
0x004911ba
0x004911bf
0x004911c5
0x004911ca
0x004911d2
0x004911d6
0x004911d6
0x004911d6
0x004911d8
0x004911df
0x00491260
0x00491268
0x004911e1
0x004911e5
0x00491208
0x0049121a
0x004911e7
0x004911ed
0x00491200
0x00491200
0x00491221
0x0049122d
0x00491235
0x00491238
0x00491242
0x0049124f
0x00491254
0x00491254
0x00491221
0x0049126d
0x00491270
0x00491273
0x00491280

APIs

GetLastError.KERNEL32(00000000,00491281,?,0048F520,00000000), ref: 00491223

Part of subcall function 004078B4: CreateThread.KERNEL32(?,?,Function_0000787C,00000000,?,?), ref: 0040790E

GetCurrentThread.KERNEL32 ref: 0049125B
GetCurrentThreadId.KERNEL32 ref: 00491263

Strings

87G, xrefs: 0049124A
\@, xrefs: 00491242

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Thread$Current$CreateErrorLast
String ID: 87G$\@
API String ID: 3539746228-2066971451
Opcode ID: 0c7a064095abbba4d6b7da4e4b0f066ab91424e297beb825eafe8628d3b7bd59
Instruction ID: cd7bd7be20694b87a1c2bb2b5688f5d4ed930c7c57bb5d88aec25e4adc3e1893
Opcode Fuzzy Hash: 0c7a064095abbba4d6b7da4e4b0f066ab91424e297beb825eafe8628d3b7bd59
Instruction Fuzzy Hash: 3A313530904746AEDB20EB72C8417AB7FE4AF09304F40C97FE555E72E1D638A444CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004A1754, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44
windowCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E004A1754(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void* _t24;
				intOrPtr _t28;
				void* _t31;
				void* _t32;
				intOrPtr _t35;

				_t32 = __esi;
				_t31 = __edi;
				_push(0);
				_push(0);
				_t24 = __eax;
				_push(_t35);
				_push(0x4a17de);
				_push( *[fs:eax]);
				 *[fs:eax] = _t35;
				if(( *0x4b36f1 & 0x00000001) == 0) {
					E004079F4( &_v8);
				} else {
					E00407E1C( &_v8, L"/ALLUSERS\r\nInstructs Setup to install in administrative install mode.\r\n/CURRENTUSER\r\nInstructs Setup to install in non administrative install mode.\r\n");
				}
				_push(L"                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ");
				_push(_v8);
				_push(_t24);
				_push(0x4a2a64);
				_push(L"For more detailed information, please visit http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline");
				E004087A4( &_v12, _t24, 5, _t31, _t32);
				MessageBoxW(0, E004084C8(_v12), L"Setup", 0x10);
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(E004A17E5);
				return E00407A54( &_v12, 2);
			}

0x004a1754
0x004a1754
0x004a1757
0x004a1759
0x004a175c
0x004a1760
0x004a1761
0x004a1766
0x004a1769
0x004a1773
0x004a1787
0x004a1775
0x004a177d
0x004a177d
0x004a178c
0x004a1791
0x004a1794
0x004a1795
0x004a179a
0x004a17a7
0x004a17be
0x004a17c5
0x004a17c8
0x004a17cb
0x004a17dd

APIs

MessageBoxW.USER32(00000000,00000000,Setup,00000010), ref: 004A17BE

Strings

, xrefs: 004A178C
/ALLUSERSInstructs Setup to install in administrative install mode./CURRENTUSERInstructs Setup to install in non administrat, xrefs: 004A1778
For more detailed information, please visit http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline, xrefs: 004A179A
Setup, xrefs: 004A17AE

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Message
String ID: $/ALLUSERSInstructs Setup to install in administrative install mode./CURRENTUSERInstructs Setup to install in non administrat$For more detailed information, please visit http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline$Setup
API String ID: 2030045667-213867584
Opcode ID: a94d50d81a6e2cc3bfa3c026c0632b711f985fbaceea9a46abe21cd4780a8ba2
Instruction ID: 88dead5f9a7c20edb7beb83f6ba38d9cb82b01f16d90bc6a7ad013ea96492960
Opcode Fuzzy Hash: a94d50d81a6e2cc3bfa3c026c0632b711f985fbaceea9a46abe21cd4780a8ba2
Instruction Fuzzy Hash: 8101D638744308BAE311EB91CD43F9AB7ACD756B48F60047BB500B26E1D6FC6E40952D

Uniqueness

Uniqueness Score: -1.00%

Function 0042F6DC, Relevance: 7.8, APIs: 5, Instructions: 335
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0042F6DC(signed short* __eax, signed int __ecx, signed short* __edx, void* __edi, void* __esi, void* __fp0) {
				signed int _v8;
				signed char _v9;
				signed int _v12;
				signed int _v14;
				void* _v20;
				void* _v24;
				signed short* _v28;
				signed short* _v32;
				signed int _v48;
				void* __ebp;
				signed int _t150;
				signed int _t272;
				intOrPtr _t328;
				intOrPtr _t331;
				intOrPtr _t339;
				intOrPtr _t347;
				intOrPtr _t355;
				void* _t361;
				void* _t363;
				intOrPtr _t364;

				_t368 = __fp0;
				_t358 = __edi;
				_t361 = _t363;
				_t364 = _t363 + 0xffffffd4;
				_v8 = __ecx;
				_v32 = __edx;
				_v28 = __eax;
				_v9 = 1;
				_t272 =  *_v28 & 0x0000ffff;
				if((_t272 & 0x00000fff) >= 0x10f) {
					_t150 =  *_v32 & 0x0000ffff;
					if(_t150 != 0) {
						if(_t150 != 1) {
							if(E00430584(_t272,  &_v20) != 0) {
								_push( &_v14);
								if( *((intOrPtr*)( *_v20 + 8))() == 0) {
									_t275 =  *_v32 & 0x0000ffff;
									if(( *_v32 & 0xfff) >= 0x10f) {
										if(E00430584(_t275,  &_v24) != 0) {
											_push( &_v12);
											if( *((intOrPtr*)( *_v24 + 4))() == 0) {
												E00428ADC(0xb);
												goto L41;
											} else {
												if(( *_v28 & 0x0000ffff) == _v12) {
													_t143 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
													_v9 =  *(0x4ab3d2 + _v8 * 2 + _t143) & 0x000000ff;
													goto L41;
												} else {
													_push( &_v48);
													L00427130();
													_push(_t361);
													_push(0x42fad4);
													_push( *[fs:eax]);
													 *[fs:eax] = _t364;
													_t289 = _v12 & 0x0000ffff;
													E00429890( &_v48, _v12 & 0x0000ffff, _v28, __edi, __esi, __fp0);
													if((_v48 & 0x0000ffff) != _v12) {
														E004289E4(_t289);
													}
													_t131 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
													_v9 =  *(0x4ab3d2 + _v8 * 2 + _t131) & 0x000000ff;
													_pop(_t328);
													 *[fs:eax] = _t328;
													_push(0x42fb09);
													return E00429164( &_v48);
												}
											}
										} else {
											E00428ADC(0xb);
											goto L41;
										}
									} else {
										_push( &_v48);
										L00427130();
										_push(_t361);
										_push(0x42fa1b);
										_push( *[fs:eax]);
										 *[fs:eax] = _t364;
										_t294 =  *_v32 & 0x0000ffff;
										E00429890( &_v48,  *_v32 & 0x0000ffff, _v28, __edi, __esi, __fp0);
										if(( *_v32 & 0x0000ffff) != _v48) {
											E004289E4(_t294);
										}
										_v9 = E0042F4F4( &_v48, _v8, _v32, _t358, _t361, _t368);
										_pop(_t331);
										 *[fs:eax] = _t331;
										_push(0x42fb09);
										return E00429164( &_v48);
									}
								} else {
									if(( *_v32 & 0x0000ffff) == _v14) {
										_t95 = ( *((intOrPtr*)( *_v20 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4ab3d2 + _v8 * 2 + _t95) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v48);
										L00427130();
										_push(_t361);
										_push(0x42f976);
										_push( *[fs:eax]);
										 *[fs:eax] = _t364;
										_t299 = _v14 & 0x0000ffff;
										E00429890( &_v48, _v14 & 0x0000ffff, _v32, __edi, __esi, __fp0);
										if((_v48 & 0x0000ffff) != _v14) {
											E004289E4(_t299);
										}
										_t83 = ( *((intOrPtr*)( *_v20 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4ab3d2 + _v8 * 2 + _t83) & 0x000000ff;
										_pop(_t339);
										 *[fs:eax] = _t339;
										_push(0x42fb09);
										return E00429164( &_v48);
									}
								}
							} else {
								E00428ADC(__ecx);
								goto L41;
							}
						} else {
							_v9 = E0042F274(_v8, 2);
							goto L41;
						}
					} else {
						_v9 = E0042F260(0, 1);
						goto L41;
					}
				} else {
					if(_t272 != 0) {
						if(_t272 != 1) {
							if(E00430584( *_v32 & 0x0000ffff,  &_v24) != 0) {
								_push( &_v12);
								if( *((intOrPtr*)( *_v24 + 4))() == 0) {
									_push( &_v48);
									L00427130();
									_push(_t361);
									_push(0x42f887);
									_push( *[fs:eax]);
									 *[fs:eax] = _t364;
									_t306 =  *_v28 & 0x0000ffff;
									E00429890( &_v48,  *_v28 & 0x0000ffff, _v32, __edi, __esi, __fp0);
									if((_v48 & 0xfff) !=  *_v28) {
										E004289E4(_t306);
									}
									_v9 = E0042F4F4(_v28, _v8,  &_v48, _t358, _t361, _t368);
									_pop(_t347);
									 *[fs:eax] = _t347;
									_push(0x42fb09);
									return E00429164( &_v48);
								} else {
									if(( *_v28 & 0x0000ffff) == _v12) {
										_t44 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4ab3d2 + _v8 * 2 + _t44) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v48);
										L00427130();
										_push(_t361);
										_push(0x42f7f0);
										_push( *[fs:eax]);
										 *[fs:eax] = _t364;
										_t311 = _v12 & 0x0000ffff;
										E00429890( &_v48, _v12 & 0x0000ffff, _v28, __edi, __esi, __fp0);
										if((_v48 & 0xfff) != _v12) {
											E004289E4(_t311);
										}
										_t32 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4ab3d2 + _v8 * 2 + _t32) & 0x000000ff;
										_pop(_t355);
										 *[fs:eax] = _t355;
										_push(0x42fb09);
										return E00429164( &_v48);
									}
								}
							} else {
								E00428ADC(__ecx);
								goto L41;
							}
						} else {
							_v9 = E0042F274(_v8, 0);
							goto L41;
						}
					} else {
						_v9 = E0042F260(1, 0);
						L41:
						return _v9 & 0x000000ff;
					}
				}
			}

0x0042f6dc
0x0042f6dc
0x0042f6dd
0x0042f6df
0x0042f6e3
0x0042f6e6
0x0042f6e9
0x0042f6ec
0x0042f6f3
0x0042f700
0x0042f891
0x0042f897
0x0042f8ae
0x0042f8d0
0x0042f8df
0x0042f8f2
0x0042f9ac
0x0042f9b9
0x0042fa2e
0x0042fa3d
0x0042fa50
0x0042fb04
0x00000000
0x0042fa56
0x0042fa60
0x0042fafa
0x0042faff
0x00000000
0x0042fa62
0x0042fa65
0x0042fa66
0x0042fa6d
0x0042fa6e
0x0042fa73
0x0042fa76
0x0042fa79
0x0042fa83
0x0042fa90
0x0042fa92
0x0042fa92
0x0042fab6
0x0042fabb
0x0042fac0
0x0042fac3
0x0042fac6
0x0042fad3
0x0042fad3
0x0042fa60
0x0042fa30
0x0042fa30
0x00000000
0x0042fa30
0x0042f9bb
0x0042f9be
0x0042f9bf
0x0042f9c6
0x0042f9c7
0x0042f9cc
0x0042f9cf
0x0042f9d5
0x0042f9de
0x0042f9ed
0x0042f9ef
0x0042f9ef
0x0042fa02
0x0042fa07
0x0042fa0a
0x0042fa0d
0x0042fa1a
0x0042fa1a
0x0042f8f8
0x0042f902
0x0042f99c
0x0042f9a1
0x00000000
0x0042f904
0x0042f907
0x0042f908
0x0042f90f
0x0042f910
0x0042f915
0x0042f918
0x0042f91b
0x0042f925
0x0042f932
0x0042f934
0x0042f934
0x0042f958
0x0042f95d
0x0042f962
0x0042f965
0x0042f968
0x0042f975
0x0042f975
0x0042f902
0x0042f8d2
0x0042f8d2
0x00000000
0x0042f8d2
0x0042f8b0
0x0042f8bc
0x00000000
0x0042f8bc
0x0042f899
0x0042f8a2
0x00000000
0x0042f8a2
0x0042f706
0x0042f709
0x0042f720
0x0042f746
0x0042f755
0x0042f768
0x0042f826
0x0042f827
0x0042f82e
0x0042f82f
0x0042f834
0x0042f837
0x0042f83d
0x0042f846
0x0042f859
0x0042f85b
0x0042f85b
0x0042f86e
0x0042f873
0x0042f876
0x0042f879
0x0042f886
0x0042f76e
0x0042f778
0x0042f816
0x0042f81b
0x00000000
0x0042f77a
0x0042f77d
0x0042f77e
0x0042f785
0x0042f786
0x0042f78b
0x0042f78e
0x0042f791
0x0042f79b
0x0042f7ac
0x0042f7ae
0x0042f7ae
0x0042f7d2
0x0042f7d7
0x0042f7dc
0x0042f7df
0x0042f7e2
0x0042f7ef
0x0042f7ef
0x0042f778
0x0042f748
0x0042f748
0x00000000
0x0042f748
0x0042f722
0x0042f72e
0x00000000
0x0042f72e
0x0042f70b
0x0042f714
0x0042fb09
0x0042fb11
0x0042fb11
0x0042f709

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74738e14bd11834c42270b1f526ff37a822d84726435ceec5f4335d4c6c5fa18
Instruction ID: 66614a77be29197391dbf0046290447a78b6802db73ccca8e639b69c8d9a2377
Opcode Fuzzy Hash: 74738e14bd11834c42270b1f526ff37a822d84726435ceec5f4335d4c6c5fa18
Instruction Fuzzy Hash: 8AD16F74F002199FCF00DBA5D4928FEBBB5EF49300BD084BBE840A7351D638A949DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00422D94, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00422D94(void* __eax, void* __ebx, char __ecx, short* __edx, void* __edi, void* __esi, intOrPtr _a4, char _a8) {
				char _v8;
				short* _v12;
				char _v16;
				int _v20;
				int _v24;
				signed int _t58;
				char _t66;
				intOrPtr _t82;
				void* _t87;
				signed int _t93;
				void* _t96;

				_v8 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_t87 = __eax;
				_push(_t96);
				_push(0x422eca);
				_push( *[fs:eax]);
				 *[fs:eax] = _t96 + 0xffffffec;
				while(1) {
					_v24 = 0;
					if(RegQueryValueExW(_t87, _v12, 0,  &_v20, 0,  &_v24) != 0) {
						break;
					}
					_t9 =  &_a8; // 0x42300a
					if(_v20 ==  *_t9 || _v20 == _a4) {
						if(_v24 != 0) {
							__eflags = _v24 - 0x70000000;
							if(__eflags >= 0) {
								E0041F378();
							}
							_t80 = _v24 + 1 >> 1;
							E00407B7C( &_v8, _v24 + 1 >> 1, 0, __eflags);
							_t58 = RegQueryValueExW(_t87, _v12, 0,  &_v20, E00407F74( &_v8),  &_v24);
							__eflags = _t58 - 0xea;
							if(_t58 == 0xea) {
								continue;
							} else {
								__eflags = _t58;
								if(_t58 != 0) {
									break;
								}
								_t22 =  &_a8; // 0x42300a
								__eflags = _v20 -  *_t22;
								if(_v20 ==  *_t22) {
									L12:
									_t93 = _v24 >> 1;
									while(1) {
										__eflags = _t93;
										if(_t93 == 0) {
											break;
										}
										_t66 = _v8;
										__eflags =  *((short*)(_t66 + _t93 * 2 - 2));
										if( *((short*)(_t66 + _t93 * 2 - 2)) == 0) {
											_t93 = _t93 - 1;
											__eflags = _t93;
											continue;
										}
										break;
									}
									__eflags = _v20 - 7;
									if(_v20 == 7) {
										__eflags = _t93;
										if(_t93 != 0) {
											_t93 = _t93 + 1;
											__eflags = _t93;
										}
									}
									E00408644( &_v8, _t80, _t93);
									__eflags = _v20 - 7;
									if(_v20 == 7) {
										__eflags = _t93;
										if(_t93 != 0) {
											(E00407F74( &_v8))[_t93 * 2 - 2] = 0;
										}
									}
									_t37 =  &_v16; // 0x42300a
									E00407DD4( *_t37, _v8);
									break;
								}
								__eflags = _v20 - _a4;
								if(_v20 != _a4) {
									break;
								}
								goto L12;
							}
						} else {
							_t13 =  &_v16; // 0x42300a
							E004079F4( *_t13);
							break;
						}
					} else {
						break;
					}
				}
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(E00422ED1);
				return E004079F4( &_v8);
			}

0x00422d9f
0x00422da2
0x00422da5
0x00422da8
0x00422dac
0x00422dad
0x00422db2
0x00422db5
0x00422dba
0x00422dbc
0x00422dd7
0x00000000
0x00000000
0x00422de0
0x00422de3
0x00422df5
0x00422e06
0x00422e0d
0x00422e0f
0x00422e0f
0x00422e1d
0x00422e21
0x00422e3e
0x00422e43
0x00422e48
0x00000000
0x00422e4e
0x00422e4e
0x00422e50
0x00000000
0x00000000
0x00422e55
0x00422e55
0x00422e58
0x00422e62
0x00422e65
0x00422e6a
0x00422e6a
0x00422e6c
0x00000000
0x00000000
0x00422e6e
0x00422e71
0x00422e77
0x00422e69
0x00422e69
0x00000000
0x00422e69
0x00000000
0x00422e77
0x00422e79
0x00422e7d
0x00422e7f
0x00422e81
0x00422e83
0x00422e83
0x00422e83
0x00422e81
0x00422e89
0x00422e8e
0x00422e92
0x00422e94
0x00422e96
0x00422ea0
0x00422ea0
0x00422e96
0x00422ea7
0x00422ead
0x00000000
0x00422eb2
0x00422e5d
0x00422e60
0x00000000
0x00000000
0x00000000
0x00422e60
0x00422df7
0x00422df7
0x00422dfa
0x00000000
0x00422dff
0x00000000
0x00000000
0x00000000
0x00422de3
0x00422eb6
0x00422eb9
0x00422ebc
0x00422ec9

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00422ECA,?,004A136C,00000000), ref: 00422DD0
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00422ECA,?,004A136C), ref: 00422E3E

Strings

0B, xrefs: 00422EA7, 00422DF7
0B, xrefs: 00422DE0, 00422E55

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: QueryValue
String ID: 0B$0B
API String ID: 3660427363-2047223620
Opcode ID: 85ea2ee95df027a8257bc04a9519c47954d8331ee6ef31d063f3570c986b0507
Instruction ID: 98124c36cd85d2e56ec74749d84b118a58c0a5b819721e5426fed98b2f6fb40a
Opcode Fuzzy Hash: 85ea2ee95df027a8257bc04a9519c47954d8331ee6ef31d063f3570c986b0507
Instruction Fuzzy Hash: AE414F31A00229BBDB14DB95DA81ABFB3B8FF14700F91446AE800B7290D778AE41D799

Uniqueness

Uniqueness Score: -1.00%

Function 0041C8B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0041C8B0(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				short _v536;
				short* _t32;
				intOrPtr* _t47;
				intOrPtr _t56;
				void* _t61;
				intOrPtr _t63;
				void* _t67;

				_v8 = 0;
				_t47 = __edx;
				_t61 = __eax;
				_push(_t67);
				_push(0x41c993);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffdec;
				E004079F4(__edx);
				_v24 =  *(_a4 - 2) & 0x0000ffff;
				_v22 =  *(_a4 - 4) & 0x0000ffff;
				_v18 =  *(_a4 - 6) & 0x0000ffff;
				if(_t61 > 2) {
					E00407E1C( &_v8, L"yyyy");
				} else {
					E00407E1C( &_v8, 0x41c9ac);
				}
				_t32 = E004084C8(_v8);
				if(GetDateFormatW(GetThreadLocale(), 4,  &_v24, _t32,  &_v536, 0x200) != 0) {
					E0040856C(_t47, 0x100,  &_v536);
					if(_t61 == 1 &&  *((short*)( *_t47)) == 0x30) {
						_t63 =  *_t47;
						if(_t63 != 0) {
							_t63 =  *((intOrPtr*)(_t63 - 4));
						}
						E0040888C( *_t47, _t63 - 1, 2, _t47);
					}
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x41c99a);
				return E004079F4( &_v8);
			}

0x0041c8bd
0x0041c8c0
0x0041c8c2
0x0041c8c6
0x0041c8c7
0x0041c8cc
0x0041c8cf
0x0041c8d4
0x0041c8e0
0x0041c8eb
0x0041c8f6
0x0041c8fd
0x0041c916
0x0041c8ff
0x0041c907
0x0041c907
0x0041c92a
0x0041c943
0x0041c952
0x0041c958
0x0041c962
0x0041c966
0x0041c96b
0x0041c96b
0x0041c978
0x0041c978
0x0041c958
0x0041c97f
0x0041c982
0x0041c985
0x0041c992

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,0041C993), ref: 0041C936
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,0041C993), ref: 0041C93C

Strings

, xrefs: 0041C902
yyyy, xrefs: 0041C911

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: df7dc0c0cfe83e2716fada29b3ec226a844ef90c6556877d7290f236e844f23c
Instruction ID: 7872b70f8d9c9f4bf3ec9f73f967c83ea165cdf14193664953d7fcc649099f55
Opcode Fuzzy Hash: df7dc0c0cfe83e2716fada29b3ec226a844ef90c6556877d7290f236e844f23c
Instruction Fuzzy Hash: C8218371A502189BDB10EF55CD82AAEB3B8EF08740F5044BAF844E7291D6389E40C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA3C, Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040AA3C(signed short __eax, void* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				short _v22;
				short _v24;
				char _v26;
				char _v32;
				void* __ebp;
				void* _t39;
				void* _t55;
				void* _t59;
				short* _t62;
				signed short _t66;
				void* _t67;
				void* _t68;
				signed short _t79;
				void* _t81;

				_t81 = __edx;
				_t66 = __eax;
				_v16 = 0;
				if(__eax !=  *0x4afc08()) {
					_v16 = E0040A9F8( &_v8);
					_t79 = _t66;
					_v20 = 3;
					_t62 =  &_v26;
					do {
						 *_t62 =  *(0xf + "0123456789ABCDEF") & 0x000000ff;
						_t79 = (_t79 & 0x0000ffff) >> 4;
						_v20 = _v20 - 1;
						_t62 = _t62 - 2;
					} while (_v20 != 0xffffffff);
					_v24 = 0;
					_v22 = 0;
					 *0x4afc04(4,  &_v32,  &_v20);
				}
				_t39 = E0040A9F8( &_v12);
				_t67 = _t39;
				if(_t67 != 0) {
					_t55 = _v12 - 2;
					if(_t55 >= 0) {
						_t59 = _t55 + 1;
						_v20 = 0;
						do {
							if( *((short*)(_t67 + _v20 * 2)) == 0) {
								 *((short*)(_t67 + _v20 * 2)) = 0x2c;
							}
							_v20 = _v20 + 1;
							_t59 = _t59 - 1;
						} while (_t59 != 0);
					}
					E00408530(_t81, _t67);
					_t39 = E0040540C(_t67);
				}
				if(_v16 != 0) {
					 *0x4afc04(0, 0,  &_v20);
					_t68 = E0040A9F8( &_v12);
					if(_v8 != _v12 || E0040A9D4(_v16, _v12, _t68) != 0) {
						 *0x4afc04(8, _v16,  &_v20);
					}
					E0040540C(_t68);
					return E0040540C(_v16);
				}
				return _t39;
			}

0x0040aa44
0x0040aa46
0x0040aa4a
0x0040aa56
0x0040aa60
0x0040aa63
0x0040aa65
0x0040aa6c
0x0040aa6f
0x0040aa80
0x0040aa86
0x0040aa89
0x0040aa8c
0x0040aa8f
0x0040aa95
0x0040aa9b
0x0040aaab
0x0040aaab
0x0040aab4
0x0040aab9
0x0040aabd
0x0040aac2
0x0040aac7
0x0040aac9
0x0040aaca
0x0040aad1
0x0040aad9
0x0040aade
0x0040aade
0x0040aae4
0x0040aae7
0x0040aae7
0x0040aad1
0x0040aaee
0x0040aaf5
0x0040aaf5
0x0040aafe
0x0040ab08
0x0040ab16
0x0040ab1e
0x0040ab3b
0x0040ab3b
0x0040ab43
0x00000000
0x0040ab4b
0x0040ab55

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040AA4D
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040AAAB
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040AB08
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040AB3B

Part of subcall function 0040A9F8: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040AAB9), ref: 0040AA0F
Part of subcall function 0040A9F8: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040AAB9), ref: 0040AA2C

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: cd06836042f7dc8c715063394acf5e4e52feefd8764bcfa4f6b7f58fc5ac6852
Instruction ID: b1904a49824afe99751246d4952eda1d7de773daf142b1b34e0f1b3e25ee96c1
Opcode Fuzzy Hash: cd06836042f7dc8c715063394acf5e4e52feefd8764bcfa4f6b7f58fc5ac6852
Instruction Fuzzy Hash: 07317A70A0021A9BDB10EBE9C885AAFB7B8FF04304F40427AE911F72D1DB789E45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040E4A8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040E4A8(void* __ebx, void* __esi, struct HINSTANCE__* _a4, char _a8) {
				char _v8;
				_Unknown_base(*)()* _v12;
				CHAR* _t31;
				intOrPtr _t38;
				intOrPtr _t39;
				struct HINSTANCE__* _t41;
				void* _t43;
				void* _t44;
				intOrPtr _t45;

				_t43 = _t44;
				_t45 = _t44 + 0xfffffff8;
				_v8 = 0;
				_t2 =  &_a8; // 0x42300a
				_t31 =  *_t2;
				_t41 = _a4;
				_push(_t43);
				_push(0x40e546);
				_push( *[fs:eax]);
				 *[fs:eax] = _t45;
				if(_t31 >> 0x10 != 0) {
					_push(_t43);
					 *[fs:eax] = _t45;
					E00407A18( &_v8);
					E00408104( &_v8, 0, _t31,  *[fs:eax]);
					_v12 = GetProcAddress(_t41, E004081CC(_v8));
					_t38 = 0x40e529;
					 *[fs:eax] = _t38;
					_push(E0040E530);
					return E00407A18( &_v8);
				} else {
					_v12 = GetProcAddress(_t41, _t31);
					_pop(_t39);
					 *[fs:eax] = _t39;
					_push(E0040E54D);
					return E00407A18( &_v8);
				}
			}

0x0040e4a9
0x0040e4ab
0x0040e4b2
0x0040e4b5
0x0040e4b5
0x0040e4b8
0x0040e4bd
0x0040e4be
0x0040e4c3
0x0040e4c6
0x0040e4ce
0x0040e4de
0x0040e4e7
0x0040e4ed
0x0040e4fc
0x0040e510
0x0040e515
0x0040e518
0x0040e51b
0x0040e528
0x0040e4d0
0x0040e4d7
0x0040e532
0x0040e535
0x0040e538
0x0040e545
0x0040e545

APIs

GetProcAddress.KERNEL32(?,0B), ref: 0040E4D2
GetProcAddress.KERNEL32(?,00000000), ref: 0040E50B

Strings

0B, xrefs: 0040E4B5, 0040E4D0

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressProc
String ID: 0B
API String ID: 190572456-3041020555
Opcode ID: 73c9e18d93592e43fe666bfe4bf432486626273dc5cba755a9ef1ec8c293c77a
Instruction ID: 64ac29280dfebcd60019ca95f25d34e387ec400068b91dc547cac48b7599c2c3
Opcode Fuzzy Hash: 73c9e18d93592e43fe666bfe4bf432486626273dc5cba755a9ef1ec8c293c77a
Instruction Fuzzy Hash: 6D117770614608BFE701DF62DC5295EB7ACDB49718BA14C7BF404F26C1E63C5F109559

Uniqueness

Uniqueness Score: -1.00%

Function 00421B7C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00421B7C(int __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				struct _cpinfo _v24;
				void* __ebp;
				void* _t14;
				struct _cpinfo _t20;
				void* _t23;
				void* _t29;
				int _t30;
				intOrPtr _t31;
				void* _t32;
				void* _t34;
				void* _t35;
				void* _t36;
				int _t40;

				_t32 = __edx;
				_t30 = __ecx;
				if(__edx != 0) {
					_t36 = _t36 + 0xfffffff0;
					_t14 = E00406284(_t14, _t35);
				}
				_t29 = _t32;
				_t34 = _t14;
				if(_t30 != 0) {
					 *(_t34 + 0xc) = _t30;
				} else {
					 *(_t34 + 0xc) = GetACP();
				}
				 *((intOrPtr*)(_t34 + 0x10)) = _a8;
				 *((intOrPtr*)(_t34 + 0x14)) = _a4;
				_t40 = GetCPInfo( *(_t34 + 0xc),  &_v24);
				if(_t40 == 0) {
					_t31 =  *0x4ac694; // 0x40ec78
					E0041F440(_t31, 1);
					E004070F0();
				}
				_t20 = _v24;
				 *(_t34 + 8) = _t20;
				 *((char*)(_t34 + 4)) = _t20 - 0x00000001 & 0xffffff00 | _t40 == 0x00000000;
				_t23 = _t34;
				if(_t29 != 0) {
					E004062DC(_t23);
					_pop( *[fs:0x0]);
				}
				return _t34;
			}

0x00421b7c
0x00421b7c
0x00421b86
0x00421b88
0x00421b8b
0x00421b8b
0x00421b90
0x00421b92
0x00421b96
0x00421ba2
0x00421b98
0x00421b9d
0x00421b9d
0x00421ba8
0x00421bae
0x00421bbe
0x00421bc0
0x00421bc2
0x00421bcf
0x00421bd4
0x00421bd4
0x00421bd9
0x00421bdc
0x00421be3
0x00421be6
0x00421bea
0x00421bec
0x00421bf1
0x00421bf8
0x00421c02

APIs

GetACP.KERNEL32 ref: 00421B98
GetCPInfo.KERNEL32(?,?), ref: 00421BB9

Strings

x@, xrefs: 00421BC2

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Info
String ID: x@
API String ID: 1807457897-1747526965
Opcode ID: cf44248a1c658bdd47b36df632dd9645ef3597e39912394a14df77dcb10368e0
Instruction ID: 462749be72c426496f1a41d89de2effdbae1b1a2d75a6ab79572deab56c71eea
Opcode Fuzzy Hash: cf44248a1c658bdd47b36df632dd9645ef3597e39912394a14df77dcb10368e0
Instruction Fuzzy Hash: 9C012631A006008FC320EF6AE881957BBF89F14358700853FFC49C7752E639E9008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00422EE8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00422EE8(void* __eax, short* __ecx, void* __edx, void** _a4, char _a8, int _a12) {
				short* _t8;
				void* _t9;
				int _t10;

				_t9 = __edx;
				_t8 = __ecx;
				_t1 =  &_a8; // 0x42300a
				_t10 =  *_t1;
				if(__eax == 2) {
					_t10 = _t10 | 0x00000100;
				}
				return RegOpenKeyExW(_t9, _t8, _a12, _t10, _a4);
			}

0x00422ee8
0x00422ee8
0x00422eec
0x00422eec
0x00422ef1
0x00422ef3
0x00422ef3
0x00422f0b

APIs

RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,0B,?,00000000,?,00422FAA,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042300A), ref: 00422F04

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00422F02
0B, xrefs: 00422EEC, 00422EFD

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: Open
String ID: 0B$Control Panel\Desktop\ResourceLocale
API String ID: 71445658-3141456704
Opcode ID: 3b69ebcaa1c44acc297296391af532f1a488bbb5d67ca1580915a5ac9ed8a3b1
Instruction ID: 754d8ca44475c60336da28a52261fe1ed214884b621adf6beb20dea320f59cf5
Opcode Fuzzy Hash: 3b69ebcaa1c44acc297296391af532f1a488bbb5d67ca1580915a5ac9ed8a3b1
Instruction Fuzzy Hash: ABD092729102287BAB109A89DC41DFB7B9DAB19360F41852AFD4497200C2B4AC519BE8

Uniqueness

Uniqueness Score: -1.00%

Function 00420ACC, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00420ACC() {
				void* __ebx;
				struct HINSTANCE__* _t1;
				void* _t4;

				_t1 = GetModuleHandleW(L"kernel32.dll");
				_t3 = _t1;
				if(_t1 != 0) {
					_t1 = E0040E4A8(_t3, _t4, _t3, L"GetDiskFreeSpaceExW");
					 *0x4a9e30 = _t1;
				}
				if( *0x4a9e30 == 0) {
					 *0x4a9e30 = E0041A5FC;
					return E0041A5FC;
				}
				return _t1;
			}

0x00420ad2
0x00420ad7
0x00420adb
0x00420ae3
0x00420ae8
0x00420ae8
0x00420af4
0x00420afb
0x00000000
0x00420afb
0x00420b01

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00420BA8,00000000,00420BC0,?,?,00420B5D), ref: 00420AD2

Part of subcall function 0040E4A8: GetProcAddress.KERNEL32(?,0B), ref: 0040E4D2

Strings

GetDiskFreeSpaceExW, xrefs: 00420ADD
kernel32.dll, xrefs: 00420ACD

Memory Dump Source

Source File: 00000004.00000002.723660225.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.723654362.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723737861.00000000004A9000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723747423.00000000004B2000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.723755488.00000000004B6000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.723761288.00000000004B8000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: d3fba4843dc8b289438757c69ca8191ca322e81c70d910c138525665c107990f
Instruction ID: 4be4f1343aa80eda7f8312904a91226add29b11054fd17f8baa2da6a23536271
Opcode Fuzzy Hash: d3fba4843dc8b289438757c69ca8191ca322e81c70d910c138525665c107990f
Instruction Fuzzy Hash: 71D05EB03203115FE710DBE5A8C1B5B2ECAA307319F80043BA40065293C7BD9C50C71C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Driver_Updater.tmp PID: 6364 Parent PID: 1088 Driver_Updater.tmpCOMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	1782
Total number of Limit Nodes:	108

Executed Functions

Function 005A43D0, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005A4412
GetVersion.KERNEL32(00000000,005A45BB,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005A442F
GetModuleHandleW.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,005A45BB,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005A4449
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,005A45BB,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005A4464
FreeSid.ADVAPI32(00000000,005A45C2,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005A45B5

Strings

CheckTokenMembership, xrefs: 005A443F
advapi32.dll, xrefs: 005A4444
"d, xrefs: 005A44E1, 005A4511, 005A451C, 005A4520, 005A44E4, 005A451F, 005A4523

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AllocateCheckFreeHandleInitializeMembershipModuleTokenVersion
String ID: CheckTokenMembership$advapi32.dll$"d
API String ID: 2691416632-3419945155
Opcode ID: 6035384f0be8bffbb6091d7286a8d61865775141e390b65ac26e64e696c496cb
Instruction ID: 8be25b1eaa60826a9289c4b804e0d8c89bfcc54eba99b55f2596c762bcfabe6e
Opcode Fuzzy Hash: 6035384f0be8bffbb6091d7286a8d61865775141e390b65ac26e64e696c496cb
Instruction Fuzzy Hash: 10516671E053056BDB10EBE58C42BAE7BA8FB4E304F200866FA00E7592D6B8D9418B65

Uniqueness

Uniqueness Score: -1.00%

Function 00601C6C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00601D02,?,00000000,00000000,?,00601D18,?,0060596B), ref: 00601C89
CoCreateInstance.OLE32(00652B18,00000000,00000001,00652B28,00000000,00000000,00601D02,?,00000000,00000000,?,00601D18,?,0060596B), ref: 00601CAF

Strings

(+e, xrefs: 00601C9F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateInstanceVersion
String ID: (+e
API String ID: 1462612201-2193073908
Opcode ID: 7f0fb1c261bc18011f4cffbc940c87181d0ec2ef76144eb024790562188bb7c6
Instruction ID: 59973373eca4dea7f3b02cb4b04290ee2b93c9a945b66a55126d418ec8031c36
Opcode Fuzzy Hash: 7f0fb1c261bc18011f4cffbc940c87181d0ec2ef76144eb024790562188bb7c6
Instruction Fuzzy Hash: A011C030280205AFEB05DBA5CD46F9AB7EEEB0A705F5240A5F500DB2E1DB79DE048715

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD4C, Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040CE0C,?,?), ref: 0040CD7E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040CE0C,?,?), ref: 0040CD87

Part of subcall function 0040CBFC: FindFirstFileW.KERNEL32(00000000,?,00000000,0040CC5A,?,?), ref: 0040CC2F
Part of subcall function 0040CBFC: FindClose.KERNEL32(00000000,00000000,?,00000000,0040CC5A,?,?), ref: 0040CC3F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: cff3a771b4cd9330fe69c64e8ee45a113bd77ee1a77b8c2479f5eb231e02d6b2
Instruction ID: 1e6bc69c0a1381f92b9e69733a46d54d0aa19dc84cca161867292b39dd9e4508
Opcode Fuzzy Hash: cff3a771b4cd9330fe69c64e8ee45a113bd77ee1a77b8c2479f5eb231e02d6b2
Instruction Fuzzy Hash: 96116670A00209DBDB00EBA6D992AAEB7B8EF48304F50457FB504B73D2DB785E05C669

Uniqueness

Uniqueness Score: -1.00%

Function 005EA2D0, Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,005EA333,?,?,?,00000000), ref: 005EA30D
GetLastError.KERNEL32(00000000,?,00000000,005EA333,?,?,?,00000000), ref: 005EA315

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 168c9b4c41c4ea0f718ce1a08fd9118add8ccedfb744e079e93659115c092f05
Instruction ID: 1b7011bc577df47943cd785a29aa03cc57531b971ab48fc9295898d1574b298f
Opcode Fuzzy Hash: 168c9b4c41c4ea0f718ce1a08fd9118add8ccedfb744e079e93659115c092f05
Instruction Fuzzy Hash: 9DF02D71A04244AB8B15DFBB9C0149DFBACFB897207114AB7F964D3341EA755E008195

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBFC, Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040CC5A,?,?), ref: 0040CC2F
FindClose.KERNEL32(00000000,00000000,?,00000000,0040CC5A,?,?), ref: 0040CC3F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: bfe9fc320dad8258fdd0243a276f2572e5741aaab784a45e850e39ab4e0d93b5
Instruction ID: 3a670b773e27689e6367c7af3837c4a9af7244e7933b1c0da2c77d0df124bc1d
Opcode Fuzzy Hash: bfe9fc320dad8258fdd0243a276f2572e5741aaab784a45e850e39ab4e0d93b5
Instruction Fuzzy Hash: 3CF05471514604EED711EBB9CE9395DB7ACEB4471576006B6F404F32D2EA385F00A558

Uniqueness

Uniqueness Score: -1.00%

Function 005A522C, Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 005A5239
SetSecurityDescriptorDacl.ADVAPI32(00000000,000000FF,00000000,00000000,00000001,00000001), ref: 005A5249

Part of subcall function 00411FE4: CreateMutexW.KERNEL32(?,00000001,00000000,?,00642877,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00642B9B,?,?,00000000), ref: 00411FFA

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: DescriptorSecurity$CreateDaclInitializeMutex
String ID:
API String ID: 3525989157-0
Opcode ID: 2638a17ea337ec88fef1c2f1d7dcfaea42ca14d6f0b336ba3ce4ad9e8232ae93
Instruction ID: dc41c1bf403f01e50fcf204102a3f95e2db8d65bb8f23d2a9785caaf8e82bb17
Opcode Fuzzy Hash: 2638a17ea337ec88fef1c2f1d7dcfaea42ca14d6f0b336ba3ce4ad9e8232ae93
Instruction Fuzzy Hash: 9AE065B16443006FE600DFB58C82F8B73DC9B44714F10492EB764D71D1E778D549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C820, Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040CA45,?,?), ref: 0040C859
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040CA45,?,?), ref: 0040C8A2
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040CA45,?,?), ref: 0040C8C4
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040C8E2
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040C900
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040C91E
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040C93C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040CA28,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040CA45), ref: 0040C97C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040CA28,?,80000001), ref: 0040C9A7
RegCloseKey.ADVAPI32(?,0040CA2F,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040CA28,?,80000001,Software\Embarcadero\Locales), ref: 0040CA22

Strings

Software\CodeGear\Locales, xrefs: 0040C8D8, 0040C8F6
Software\Embarcadero\Locales, xrefs: 0040C898, 0040C8BA
Software\Borland\Locales, xrefs: 0040C914
Software\Borland\Delphi\Locales, xrefs: 0040C932

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: d26a71a092777d7a7a404293e07efc613cec9f1592485332ec8d766ca02a3516
Instruction ID: 0710d48149da5ae319f413f3ef24fbf4f5cead902eccefb92f2df938dc6c631d
Opcode Fuzzy Hash: d26a71a092777d7a7a404293e07efc613cec9f1592485332ec8d766ca02a3516
Instruction Fuzzy Hash: 0A510276B4024CFEEB10EB95CC82FEE77ACDB08704F50417ABA04F62C1D6789A448A59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F038, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040F0F0

Strings

hd, xrefs: 0040F0B2
Hd, xrefs: 0040F04D

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ExceptionRaise
String ID: Hd$hd
API String ID: 3997070919-182934829
Opcode ID: f2eeacb3e0568c73eb068e16edc0a4c9dc4e1b9b1425a1587247ce4a7dca9fce
Instruction ID: 3d03e640e9451f27271753da566eb13b755240155575789a24bd73c550c96270
Opcode Fuzzy Hash: f2eeacb3e0568c73eb068e16edc0a4c9dc4e1b9b1425a1587247ce4a7dca9fce
Instruction Fuzzy Hash: B8A19075A003099FDB20DFA9D881BAEB7B5BB48300F10457EE905BB7C0DB74A949CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00635C18, Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoTaskMemFree.OLE32(?,00635E53,?,00000000,00000000,?,00641232,00000006,?,00000000,006417E8,?,00000000,006418A7), ref: 00635E46
CoTaskMemFree.OLE32(?,00635EA6,?,00000000,00000000,?,00641232,00000006,?,00000000,006417E8,?,00000000,006418A7), ref: 00635E99

Strings

Common Files, xrefs: 00635D6F
cmd.exe, xrefs: 00635EC4
CommonFilesDir, xrefs: 00635D38, 00635DB4
COMMAND.COM, xrefs: 00635EE5
ProgramFilesDir, xrefs: 00635CFE, 00635D85
\Program Files, xrefs: 00635D25
Failed to get path of 64-bit Program Files directory, xrefs: 00635DA7
Failed to get path of 64-bit Common Files directory, xrefs: 00635DD6
SystemDrive, xrefs: 00635C9D

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FreeTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 734271698-544719455
Opcode ID: c958c7089735f1724c50af40be95fa69ae9d156e1aba0c7c0931f2b24b60491f
Instruction ID: 268899ea4d3385b8e361fee9a0b8828566ed26b2d48ee26bf01146bf0efcf262
Opcode Fuzzy Hash: c958c7089735f1724c50af40be95fa69ae9d156e1aba0c7c0931f2b24b60491f
Instruction Fuzzy Hash: 9171D1307006049BDB10EFE4D947A9E7BB7EB88305F50553AF841A7391CB38AD059FA6

Uniqueness

Uniqueness Score: -1.00%

Function 005AC0A0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 005AC0B1

Part of subcall function 004D0750: EnterCriticalSection.KERNEL32(?,00000000,004D09BF,?,?), ref: 004D0798

SelectObject.GDI32($O`,00000000), ref: 005AC0D3
GetTextExtentPointW.GDI32($O`,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 005AC0E7
GetTextMetricsW.GDI32($O`,?,00000000,005AC12C,?,00000000,?,?,00604F24), ref: 005AC109
ReleaseDC.USER32 ref: 005AC126

Strings

$O`, xrefs: 005AC0CF, 005AC0E3, 005AC105, 005AC120, 005AC0D2, 005AC0E6, 005AC108, 005AC123
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 005AC0DE

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Text$CriticalEnterExtentMetricsObjectPointReleaseSectionSelect
String ID: $O`$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1334710084-237595332
Opcode ID: b5b916d27d189161da9767cd2e8e3459c7015de9901a2091dbfd2c8bb4b70af7
Instruction ID: 5271e8d48229fc8d9a74cc6a0505171e73ae7c4dc914b397dac824714bb3a41d
Opcode Fuzzy Hash: b5b916d27d189161da9767cd2e8e3459c7015de9901a2091dbfd2c8bb4b70af7
Instruction Fuzzy Hash: 86018476B04204AFDB04DBE9CD51F9EBBECEB49704F500466B604D7381D6B4AE118764

Uniqueness

Uniqueness Score: -1.00%

Function 005ECD00, Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,005ECF30,005ECF30,?,005ECF30,00000000), ref: 005ECEB5
CloseHandle.KERNEL32(006414CB,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,005ECF30,005ECF30,?,005ECF30), ref: 005ECEC2

Part of subcall function 005ECC6C: WaitForInputIdle.USER32 ref: 005ECC98
Part of subcall function 005ECC6C: MsgWaitForMultipleObjects.USER32 ref: 005ECCBA
Part of subcall function 005ECC6C: GetExitCodeProcess.KERNEL32 ref: 005ECCCB
Part of subcall function 005ECC6C: CloseHandle.KERNEL32(00000001,005ECCF8,005ECCF1,?,?,?,00000001,?,?,005ED09A,?,00000000,005ED0B0,?,?,?), ref: 005ECCEB

Strings

.cmd, xrefs: 005ECDB7
.bat, xrefs: 005ECD9C
COMMAND.COM" /C , xrefs: 005ECE20
cmd.exe" /C ", xrefs: 005ECDE9
D, xrefs: 005ECE54

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 529d2570913f365558aaa947452e1084d0ed2d18085b3376b319e8bc129c6106
Instruction ID: 0b7c01194dcd5915e6048f3552e9a0c6d9dceeac1f337f18381b92e2394d53a0
Opcode Fuzzy Hash: 529d2570913f365558aaa947452e1084d0ed2d18085b3376b319e8bc129c6106
Instruction Fuzzy Hash: 3B514330A0028D9BCF15EFA6C982ADEBFB9BF45704F50403AB454A7286D774DE06DB54

Uniqueness

Uniqueness Score: -1.00%

Function 005962FC, Relevance: 10.6, APIs: 7, Instructions: 105
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00596310
IsWindowUnicode.USER32 ref: 00596324
PeekMessageW.USER32 ref: 00596347
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0059635D
TranslateMessage.USER32 ref: 005963E2
DispatchMessageW.USER32 ref: 005963EF
DispatchMessageA.USER32 ref: 005963F7

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
String ID:
API String ID: 2190272339-0
Opcode ID: b505dac5081caec79563f99069b5c2410f2126aafcfc4f2e5144c69dda22b2cb
Instruction ID: b3dcd82f525f2ccfe4c8ec4e97d82f02c620822d9fe4adc89b046b09657a812e
Opcode Fuzzy Hash: b505dac5081caec79563f99069b5c2410f2126aafcfc4f2e5144c69dda22b2cb
Instruction Fuzzy Hash: 8A21073034435026FF356E290E86BBEAE95EFD2708F144819F585D7183DB99984F421A

Uniqueness

Uniqueness Score: -1.00%

Function 005A59B8, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 005A59E7
GetFocus.USER32(00000000,005A5ACA,?,?,00000000,00000001,00000000,?,0060C783,0065A16C,?,00000000,00642AEE,?,00000001,00000000), ref: 005A59EF
RegisterClassW.USER32 ref: 005A5A10
ShowWindow.USER32(00000000,00000008,00000000,?,00000000,41178000,00000000,00000000,00000000,00000000,80000000,00000000,?,00000000,00000000,00000000), ref: 005A5AA8
SetFocus.USER32(00000000,00000000,005A5ACA,?,?,00000000,00000001,00000000,?,0060C783,0065A16C,?,00000000,00642AEE,?,00000001), ref: 005A5AAF

Strings

TWindowDisabler-Window, xrefs: 005A5A47, 005A5A90

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FocusWindow$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 495420250-1824977358
Opcode ID: 2fb9b116738596a1e0afb903f50ba267de6d1b1f75f886a1ed0846ab53d7e5dd
Instruction ID: d9b2cc6840da12512848ad8eedaef7fd359135de9f53516b34ed03f793c6e221
Opcode Fuzzy Hash: 2fb9b116738596a1e0afb903f50ba267de6d1b1f75f886a1ed0846ab53d7e5dd
Instruction Fuzzy Hash: EF21EF71B40B01AFD310EB79CD42F2E7AA5FB41B01F114629B900EB2C1E6B4AC50C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 0064D4A0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040EFEC: GetModuleHandleW.KERNEL32(00000000,?,0064D4B3), ref: 0040EFF8

GetWindowLongW.USER32(?,000000EC), ref: 0064D4C3
SetWindowLongW.USER32 ref: 0064D4DF
SetErrorMode.KERNEL32(00000001,00000000,0064D524,?,?,000000EC,00000000), ref: 0064D4F4

Part of subcall function 00642EA0: GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0064D4FE,00000001,00000000,0064D524,?,?,000000EC,00000000), ref: 00642EAA

Part of subcall function 0059644C: SendMessageW.USER32(?,0000B020,00000000,?), ref: 00596471

Part of subcall function 00595F5C: SetWindowTextW.USER32(?,00000000), ref: 00595F8D

ShowWindow.USER32(?,00000005,00000000,0064D524,?,?,000000EC,00000000), ref: 0064D55E

Strings

Setup, xrefs: 0064D544
pc, xrefs: 0064D56A

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window$HandleLongModule$ErrorMessageModeSendShowText
String ID: Setup$pc
API String ID: 1533765661-3660760854
Opcode ID: 8453979f9757b2b6af1ffdad24c6b83727ccd520adb1f43a5464695c07890d8e
Instruction ID: 99239e9ace0432ff927885b241a0afe2423aa3233f3e49fe6913a1ef7ffd3993
Opcode Fuzzy Hash: 8453979f9757b2b6af1ffdad24c6b83727ccd520adb1f43a5464695c07890d8e
Instruction Fuzzy Hash: 722190B4604700BFCB01EF6DDCA2D567BEAEB4E720B515164F514C77B1CA34A980CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00636254, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,006363A6,?,?,00000005,00000000,00000000,?,00642955,00000000,00642B08,?,00000000,00642B6C), ref: 006362DF
GetLastError.KERNEL32(00000000,00000000,00000000,006363A6,?,?,00000005,00000000,00000000,?,00642955,00000000,00642B08,?,00000000,00642B6C), ref: 006362E8

Strings

Created temporary directory: , xrefs: 00636291
\_setup64.tmp, xrefs: 0063635E
_isetup, xrefs: 006362CA

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: c7eee5d2907e7c8cba69f56ec260abd86d1687ac3d1b65c7476fc71c717453f3
Instruction ID: dce086d454b6534baab4b2c011f4e8eb466f83b1850ff865cfb80c436dd11fcb
Opcode Fuzzy Hash: c7eee5d2907e7c8cba69f56ec260abd86d1687ac3d1b65c7476fc71c717453f3
Instruction Fuzzy Hash: 7B411774A00109ABDB05EF94D852ADEB7F6FF84304F108136F501A7392DB74AE05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004210CC, Relevance: 7.5, APIs: 5, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 004210DC
GetLastError.KERNEL32(00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 004210EB
GetFileAttributesW.KERNEL32(00000000,00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000,00000000), ref: 004210F3
RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000), ref: 0042110E
SetLastError.KERNEL32(00000000,00000000,00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000), ref: 0042111C

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorFileLast$AttributesDeleteDirectoryRemove
String ID:
API String ID: 2814369299-0
Opcode ID: 97b73e854961baa2ce1c59846fc3cdd9964de0629a2998a0e244950a43752649
Instruction ID: 56de61ba13cc10ac5a03dba103e106efa26abbfc9da42fd87a77cee8a775e7f8
Opcode Fuzzy Hash: 97b73e854961baa2ce1c59846fc3cdd9964de0629a2998a0e244950a43752649
Instruction Fuzzy Hash: E5F0EC6134022859DA2435BE2DC2ABF515CC94676DB50073FFB50D31A3C97D4C66416D

Uniqueness

Uniqueness Score: -1.00%

Function 0040843C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040846C
FreeLibrary.KERNEL32(00400000,?,?,?,00408576,0040559F,004055E6,?,?,004055FF,?,?,?,?,004A0E5A,00000000), ref: 00408514
ExitProcess.KERNEL32(00000000,?,?,?,00408576,0040559F,004055E6,?,?,004055FF,?,?,?,?,004A0E5A,00000000), ref: 0040854D

Part of subcall function 004083A4: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?,00408576,0040559F,004055E6,?,?,004055FF), ref: 004083DD
Part of subcall function 004083A4: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?,00408576,0040559F,004055E6,?,?), ref: 004083E3
Part of subcall function 004083A4: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?), ref: 004083FE
Part of subcall function 004083A4: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?), ref: 00408404

Strings

MZP, xrefs: 00408513

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 78d86fb2bf2bf2e21ccd9c06c2f1e221edbbdf5316c32f4d18dde5cd064fff3e
Instruction ID: 78054232ab430f224924438cf7dbfd6367a6ce4b95e7ecb1a6dc1622063fce84
Opcode Fuzzy Hash: 78d86fb2bf2bf2e21ccd9c06c2f1e221edbbdf5316c32f4d18dde5cd064fff3e
Instruction Fuzzy Hash: 4E317E60A007429ADB30AF698A8871B7AE5AB55319F15053FA485A32D2DF7CD8C8C719

Uniqueness

Uniqueness Score: -1.00%

Function 00408434, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040846C
FreeLibrary.KERNEL32(00400000,?,?,?,00408576,0040559F,004055E6,?,?,004055FF,?,?,?,?,004A0E5A,00000000), ref: 00408514
ExitProcess.KERNEL32(00000000,?,?,?,00408576,0040559F,004055E6,?,?,004055FF,?,?,?,?,004A0E5A,00000000), ref: 0040854D

Part of subcall function 004083A4: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?,00408576,0040559F,004055E6,?,?,004055FF), ref: 004083DD
Part of subcall function 004083A4: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?,00408576,0040559F,004055E6,?,?), ref: 004083E3
Part of subcall function 004083A4: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?), ref: 004083FE
Part of subcall function 004083A4: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?), ref: 00408404

Strings

MZP, xrefs: 00408513

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: afed891bfa8eb145adbec0aa145b961b180110e163f2f92655622ef4fecb354b
Instruction ID: afdb55dbc8c585736216f1129d15da0812888cb93493e4522a4028f6bb944287
Opcode Fuzzy Hash: afed891bfa8eb145adbec0aa145b961b180110e163f2f92655622ef4fecb354b
Instruction Fuzzy Hash: 6931BE609003829ADB31AF758A887167BE16B05319F15087FE4C5A32D2DF7CD8C8C71D

Uniqueness

Uniqueness Score: -1.00%

Function 0046DA00, Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassInfoW.USER32 ref: 0046DA21
UnregisterClassW.USER32 ref: 0046DA4A
RegisterClassW.USER32 ref: 0046DA54
SetWindowLongW.USER32 ref: 0046DA9F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 09bf45d9904320e38b05d9661d659d83872680fe83171a5fa97a5217a72bb5c3
Instruction ID: eaf16334c5f0c60b372357798d38c4b1ddccb815e9754486c70d5869802b7d78
Opcode Fuzzy Hash: 09bf45d9904320e38b05d9661d659d83872680fe83171a5fa97a5217a72bb5c3
Instruction Fuzzy Hash: 7401A171B08300AFDB00FB9DDD81F9A779AEB48315F105216B904D7391E675DD60C799

Uniqueness

Uniqueness Score: -1.00%

Function 005ECC6C, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32 ref: 005ECC98
MsgWaitForMultipleObjects.USER32 ref: 005ECCBA
GetExitCodeProcess.KERNEL32 ref: 005ECCCB
CloseHandle.KERNEL32(00000001,005ECCF8,005ECCF1,?,?,?,00000001,?,?,005ED09A,?,00000000,005ED0B0,?,?,?), ref: 005ECCEB

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 2ebf960bc5b73c1039df4907ac0b8a35a8769a623c10a24edbb3b32f214b1c19
Instruction ID: 0b1ea4fae32b673ec28d52ca53679023a97ccef2bb0f5596a062c9fe025a027a
Opcode Fuzzy Hash: 2ebf960bc5b73c1039df4907ac0b8a35a8769a623c10a24edbb3b32f214b1c19
Instruction Fuzzy Hash: 9501F570A402487EEB1897AA8D06EAE7FACEB09760F700122F62CD32D1C6B4DD41C665

Uniqueness

Uniqueness Score: -1.00%

Function 00636440, Relevance: 6.0, APIs: 4, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00636460
GetLastError.KERNEL32 ref: 0063646A
GetTickCount.KERNEL32 ref: 00636474
Sleep.KERNEL32(00000032), ref: 00636484

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: ef050c5fc241401a9c8fb7b637c22a61dd5afb65b30f956bc3e270f13bd38745
Instruction ID: e25aaaa3a608eb0764e34d3907372fffaa84d46f21896ce1c423577bf7bea796
Opcode Fuzzy Hash: ef050c5fc241401a9c8fb7b637c22a61dd5afb65b30f956bc3e270f13bd38745
Instruction Fuzzy Hash: 66E02B32B0C14028862AB5FE58854BD49D6DEC2354F25C57FF1D4C2113C445484582E7

Uniqueness

Uniqueness Score: -1.00%

Function 005EB53C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,005EB631,?,0065A16C,?,00000003,00000000,00000000,?,0063627B,00000000,006363A6), ref: 005EB584
GetLastError.KERNEL32(00000000,00000000,?,00000000,005EB631,?,0065A16C,?,00000003,00000000,00000000,?,0063627B,00000000,006363A6), ref: 005EB58D

Strings

.tmp, xrefs: 005EB56D

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: d967bb4ce6cf3e4b37adf2e0dd0cf36d62edfd95e7d1731cdc90b49cb0c47c70
Instruction ID: 71fd6045300f4134a5b39da9a16414624d12d965e2f298467dc9364522841c4c
Opcode Fuzzy Hash: d967bb4ce6cf3e4b37adf2e0dd0cf36d62edfd95e7d1731cdc90b49cb0c47c70
Instruction Fuzzy Hash: 6D217675A002499FEB05EBA5CC52ADFB7F9FB88304F10407AF541A3341DB74AE018AA4

Uniqueness

Uniqueness Score: -1.00%

Function 00635B5C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,00635EF4,00000000,00635F0F,?,00000000,00000000,?,00641232,00000006), ref: 00635BBE

Strings

RegisteredOwner, xrefs: 00635B9B
RegisteredOrganization, xrefs: 00635BAD

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 55d83adc498d298bef959ee7db6a720d26436d20d8eb09dbfb9a2e6f52772712
Instruction ID: fe621046acbe2d505b568ef2ebb7d6073792f3e187ed3d1f27f626681cff0ee7
Opcode Fuzzy Hash: 55d83adc498d298bef959ee7db6a720d26436d20d8eb09dbfb9a2e6f52772712
Instruction Fuzzy Hash: 96F0BB30708204ABD700DBE4AD96B5FBB5BE786301F641065F3025B3D1C7B4AD00D754

Uniqueness

Uniqueness Score: -1.00%

Function 005E9A3C, Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,?,?,?), ref: 005E9A5C
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,005E9AD3,?,00000000,?,?,?,?), ref: 005E9A89
VerQueryValueW.VERSION(?,005E9AFC,?,?,00000000,?,00000000,?,00000000,005E9AD3,?,00000000,?,?,?,?), ref: 005E9AA3

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: cdcdfe8f14c20e31e9a23780454d16b1fff429fc28bde454a9e3df50ab498a09
Instruction ID: 1fb48db7ed0a76e7de24ade95d8deeb899b8659ae3da3e008543392c24114c66
Opcode Fuzzy Hash: cdcdfe8f14c20e31e9a23780454d16b1fff429fc28bde454a9e3df50ab498a09
Instruction Fuzzy Hash: 71218471A04249AEDB05DAAA88429FFBBFDEF45714F4504BAF840E3241D6749E00C765

Uniqueness

Uniqueness Score: -1.00%

Function 00405374, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00654ADC,00000000,00008000), ref: 00405392
VirtualFree.KERNEL32(00656B80,00000000,00008000), ref: 0040540E

Strings

|Ke, xrefs: 004053CD

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FreeVirtual
String ID: |Ke
API String ID: 1263568516-2365541183
Opcode ID: 3e5cc1c5cd4f9b1858885007e7deee85219b4d1650f755776562d4be453dec0f
Instruction ID: 51411e9e4f174b8b2d195e3858588647e18d209aceb78b56fdaf3462b05fefee
Opcode Fuzzy Hash: 3e5cc1c5cd4f9b1858885007e7deee85219b4d1650f755776562d4be453dec0f
Instruction Fuzzy Hash: ED1182B16016009FD7649F199840B17BAE5F784715F2580BEE509EF781DA78DC41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00637D50, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 148windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageW.USER32(003802C0,00000496,00002711,-00000001), ref: 00637F78

Strings

MS PGothic, xrefs: 00637DCC, 00637DDF

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: MessageNotifySend
String ID: MS PGothic
API String ID: 3556456075-3532686627
Opcode ID: e5749daa967823459fdeaefec4be1a6f65d77a60ac0ff4438c33e858d093da55
Instruction ID: 6f65c066beb337809f18ef5189d5c66f0ff8a1cbcc623e9be8b007d16ca78b78
Opcode Fuzzy Hash: e5749daa967823459fdeaefec4be1a6f65d77a60ac0ff4438c33e858d093da55
Instruction Fuzzy Hash: AF51A3F0314205CFCB10EF65E985A5A77A3FB89306F54927AA8049F3A6DA34DC42CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 00636494, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006364DC

Strings

Failed to remove temporary directory: , xrefs: 006364FE

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 0180d6ccb14a4ed4752ec0429b6bc5050152c6e6749881499f4f3fe23e9b1eb9
Instruction ID: 6bf5f438c58430aa21d9d39cf3193b030e73b1f05efc44fa574aab31c3e1015d
Opcode Fuzzy Hash: 0180d6ccb14a4ed4752ec0429b6bc5050152c6e6749881499f4f3fe23e9b1eb9
Instruction Fuzzy Hash: 3101BC30650304BAEB12EFB1DC0BB9A3BE7EB48B10F618975F500932D2DAB99D00D655

Uniqueness

Uniqueness Score: -1.00%

Function 00412E84, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00412EC3

Strings

TWindowDisabler-Window, xrefs: 00412EC1

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateWindow
String ID: TWindowDisabler-Window
API String ID: 716092398-1824977358
Opcode ID: 6c7facdfd0e66ee599a1159b40424e0c067c3ede558cbe5f898d13db70d6f81c
Instruction ID: bb8e3ddeb58cf41b6c5bd30de7c2c2887b00180dd447bf5933bbb47be1ef0363
Opcode Fuzzy Hash: 6c7facdfd0e66ee599a1159b40424e0c067c3ede558cbe5f898d13db70d6f81c
Instruction Fuzzy Hash: 89F07FB2600118AF8B80DE9DDC81EDB77ECEB4D2A4B05412ABA08E3201D634ED118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00635AAC, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A4104: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005A47DE,?,00000000,?,005A477E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005A47DE), ref: 005A4120

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,006417E8,?,00635D0A,00000000,00635F0F,?,00000000,00000000), ref: 00635AF1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00635AC3

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 6ad0d0c3e4f727d63361b846878dc9ec9d72d5106336135b8436129a908bc630
Instruction ID: 8f1b02018f3084e878ea990e92e44accb1c6db1a79b33ac038877bf5a8479c7b
Opcode Fuzzy Hash: 6ad0d0c3e4f727d63361b846878dc9ec9d72d5106336135b8436129a908bc630
Instruction Fuzzy Hash: E0F02731300104A7E600A1DE5D86BAEA3CE9BC5314F20013FF605D7342DAE09D0153A4

Uniqueness

Uniqueness Score: -1.00%

Function 0040809C, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,004080EA,?,0064E000,00656B9C,?,?,004084ED,?,?,?,00408576,0040559F,004055E6,?,?), ref: 004080DA

Strings

81d, xrefs: 004080A2

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 81d
API String ID: 2492992576-1505480649
Opcode ID: 10960fbbd0f37afa25b4c65a54ae7077b3beb19aff8004b15f209721f71424d0
Instruction ID: a55552c9480317e4c83efdacc74819adb46042ac165774ef662aa2933abb4353
Opcode Fuzzy Hash: 10960fbbd0f37afa25b4c65a54ae7077b3beb19aff8004b15f209721f71424d0
Instruction Fuzzy Hash: 58F090312057059FE7318F4AEA90A13BB9CFB587607A7403FE844A77A1DE759814C968

Uniqueness

Uniqueness Score: -1.00%

Function 005A4104, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005A47DE,?,00000000,?,005A477E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005A47DE), ref: 005A4120

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 005A411E

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Open
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 71445658-1109908249
Opcode ID: ce076c2cb336e14aab7b89f6995de6a7853b6a319f08c762a578886beb655afa
Instruction ID: e5251958779dbe226deca3b4eeefb2c80cd5fd3e52e87ec8dbe830b67a0152ec
Opcode Fuzzy Hash: ce076c2cb336e14aab7b89f6995de6a7853b6a319f08c762a578886beb655afa
Instruction Fuzzy Hash: 65D0C9729102287BAB00AB8DDC42DFB779DEB5A760F44801AFE0497100C2B4EC91CBF4

Uniqueness

Uniqueness Score: -1.00%

Function 005EBCD0, Relevance: 3.2, APIs: 2, Instructions: 192fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(000000FF,?,00000000,005EBEFA,?,00000000,005EBF6E,?,?,?,006364F1,00000000,00636440,00000000,00000000,00000001), ref: 005EBED6
FindClose.KERNEL32(000000FF,005EBF01,005EBEFA,?,00000000,005EBF6E,?,?,?,006364F1,00000000,00636440,00000000,00000000,00000001,00000001), ref: 005EBEF4

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: e972c4f453f85811a0d87aa8a12e9ef815f942c9f74e82d1b31ce58e9db3b60e
Instruction ID: e80dd1214523b732a391fd103c8b24b3e146d2fc262259e3d85170488ea8701e
Opcode Fuzzy Hash: e972c4f453f85811a0d87aa8a12e9ef815f942c9f74e82d1b31ce58e9db3b60e
Instruction Fuzzy Hash: F4816E30D042899AEF29DFA6C9857EEBFB5BF45301F1441A9E89463292C7349F44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005A3EE4, Relevance: 3.1, APIs: 2, Instructions: 112registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,?,00000000,005A401A,?,00637FA8,00000000,00000000), ref: 005A3F20
RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,70000000,00000001,?,00000000,00000000,00000000,?,00000000,005A401A,?,00637FA8), ref: 005A3F8E

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 03216e90e137dfddb3218f0ce9decdbf98795ecbb3f857e212257aee0b30b4d9
Instruction ID: db0b1c5050519b113e59c6d9795ff41349f93559cc3f6bbe9154ec7cb37e6f8b
Opcode Fuzzy Hash: 03216e90e137dfddb3218f0ce9decdbf98795ecbb3f857e212257aee0b30b4d9
Instruction Fuzzy Hash: F4414971E10119AFDB10DF95C981ABEBBB8FB46704F60446AF900FB280D778AF449B95

Uniqueness

Uniqueness Score: -1.00%

Function 005AE8B0, Relevance: 3.1, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 005AC0A0: GetDC.USER32(00000000), ref: 005AC0B1
Part of subcall function 005AC0A0: SelectObject.GDI32($O`,00000000), ref: 005AC0D3
Part of subcall function 005AC0A0: GetTextExtentPointW.GDI32($O`,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 005AC0E7
Part of subcall function 005AC0A0: GetTextMetricsW.GDI32($O`,?,00000000,005AC12C,?,00000000,?,?,00604F24), ref: 005AC109
Part of subcall function 005AC0A0: ReleaseDC.USER32 ref: 005AC126

MulDiv.KERNEL32(00605913,00000006,00000006), ref: 005AE97D
MulDiv.KERNEL32(?,?,0000000D), ref: 005AE994

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Text$ExtentMetricsObjectPointReleaseSelect
String ID:
API String ID: 844173074-0
Opcode ID: 7e5a83ed530688603f6e9a6d7196652cdb4df65cb2f162841748f007a13763a4
Instruction ID: a19cc55b1f41b30519d97d3c89c469f431b82b3e027b6e21c972cb51c7691b0d
Opcode Fuzzy Hash: 7e5a83ed530688603f6e9a6d7196652cdb4df65cb2f162841748f007a13763a4
Instruction Fuzzy Hash: B541E535A00208EFCB01DBA8D986EADBBF9FB49300F2541A5F904EB361D771AE009B50

Uniqueness

Uniqueness Score: -1.00%

Function 0040F318, Relevance: 3.1, APIs: 2, Instructions: 106COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 0040F3E7
LocalFree.KERNEL32(00000000,00000000), ref: 0040F401

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Free$LibraryLocal
String ID:
API String ID: 3007483513-0
Opcode ID: 27ccbf90c6c32dd6ce6f45082bfecf4cdf76ad0f3b6258c746885aa8a493c144
Instruction ID: 87edba83d4e9cceb9fa441504d47457c7bd9041f1947dfeea52ad5706f964a28
Opcode Fuzzy Hash: 27ccbf90c6c32dd6ce6f45082bfecf4cdf76ad0f3b6258c746885aa8a493c144
Instruction Fuzzy Hash: 4131A872900115ABC724DF95D8C196F73B8AF98314B14403EFD04B7781DB38DD458B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE18, Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040CF2F,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040CFB6,00000000,?,00000105), ref: 0040CEC3
GetSystemDefaultUILanguage.KERNEL32(00000000,0040CF2F,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040CFB6,00000000,?,00000105), ref: 0040CEEB

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 93680eb6051e83e1ef61b31bac7d2ed8329ee173ada7549af2e24ac3e119f4f5
Instruction ID: 596729fc8fd017cb2975136f5f86cc996c07360807243d60c5c52b7907f77100
Opcode Fuzzy Hash: 93680eb6051e83e1ef61b31bac7d2ed8329ee173ada7549af2e24ac3e119f4f5
Instruction Fuzzy Hash: DC312F70A14209DFDB10EB99C9C1AAEB7B5EB44704F60467BE400B73D1DB78AD41CB99

Uniqueness

Uniqueness Score: -1.00%

Function 005EA058, Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 005EA0AC
GetLastError.KERNEL32(00000000,00000000,0065A16C,?,?,0060C630,00000000,0060C614,?,00000000,00000000,005EA0D2,?,?,00000000,00000001), ref: 005EA0B4

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: d57bf6ffc9c3c317eefde2e176bccfe949134880f7c9821ff6f4fd5ce8d7f45e
Instruction ID: 2dfb14339bafda70a1707157cdb5763b07a5ccb654acc33a6885253e306b3c14
Opcode Fuzzy Hash: d57bf6ffc9c3c317eefde2e176bccfe949134880f7c9821ff6f4fd5ce8d7f45e
Instruction Fuzzy Hash: C21139B2600248AF8B55DEAEDC45DDABBECEB8D310B118566FA18D3201D634AD109B65

Uniqueness

Uniqueness Score: -1.00%

Function 00412174, Relevance: 3.1, APIs: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 0041219E
GetProcAddress.KERNEL32(?,00000000), ref: 004121D7

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: b505409bb2b6c5c1b3c8618489fb579310ea6e957dc175e5bfb36aa969615ef3
Instruction ID: c235e8af4864aa2492a3e9253a8948da1b1d6369952aa228640533ef2e312267
Opcode Fuzzy Hash: b505409bb2b6c5c1b3c8618489fb579310ea6e957dc175e5bfb36aa969615ef3
Instruction Fuzzy Hash: 8211E570614608BFD701DF61CE529DEB7ACEB4A714BA144BBF804E3281DB785E14A668

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF3C, Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040CFF6,?,?,00000000), ref: 0040CF78
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040CFF6,?,?,00000000), ref: 0040CFC9

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 1f4e2380d52d609bd7b274542df80a10bff1a013fbbefc9b33ec8f5fc500ad21
Instruction ID: bcd7cfb62d12acf44e760b2cc37d5a9a6c3f2f2744d4c9653b1ef10c08e20f9b
Opcode Fuzzy Hash: 1f4e2380d52d609bd7b274542df80a10bff1a013fbbefc9b33ec8f5fc500ad21
Instruction Fuzzy Hash: 6311BF71A4020CEBDB20EF60CC86BDEB3B9DB44704F5145BAB408B32C1DA785F80CA99

Uniqueness

Uniqueness Score: -1.00%

Function 005898F4, Relevance: 3.0, APIs: 2, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00589946
EnumThreadWindows.USER32(00000000,005898A4,00000000), ref: 0058994C

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 70b67c61e2d9797481d48fa6b9cfe1aa86131bc99be7548f98dbdfb440c890bb
Instruction ID: bf1bffc172f51048d728f669e4ff64b48adfa7dc15251b4088cf312f0de0688e
Opcode Fuzzy Hash: 70b67c61e2d9797481d48fa6b9cfe1aa86131bc99be7548f98dbdfb440c890bb
Instruction Fuzzy Hash: 8F11C0B1604349AFD711CF29FC61A16BFE9F74E710F61956AE800E3760E7355800CB11

Uniqueness

Uniqueness Score: -1.00%

Function 005EA178, Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,00000000,005EA1D5,?,?,?), ref: 005EA1AF
GetLastError.KERNEL32(00000000,00000000,005EA1D5,?,?,?), ref: 005EA1B7

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 0ca3686aa5f47bacd65e1abf2717fa98b424e4207ba78bc3f4b31bf05844f1c1
Instruction ID: 14af580e2d9197b718eba8ec73c2250dce9b66594b916b78ca97468f66734773
Opcode Fuzzy Hash: 0ca3686aa5f47bacd65e1abf2717fa98b424e4207ba78bc3f4b31bf05844f1c1
Instruction Fuzzy Hash: 39F022B1A04288AFCB0ADFB6AC0149DBBE8EB49320B114AB6F804D3201E7746E10C195

Uniqueness

Uniqueness Score: -1.00%

Function 005EA684, Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(00000000,00000000,005EA6E1,?,?,00000000), ref: 005EA6BB
GetLastError.KERNEL32(00000000,00000000,005EA6E1,?,?,00000000), ref: 005EA6C3

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 186d67372999a7063286bdd75d713dad02ff7e2c20033f03e43dbd22ba81b929
Instruction ID: 7e77f2cd7d9247c25ab572e24d68071e658bdae7ffa3348f23d016acd0160352
Opcode Fuzzy Hash: 186d67372999a7063286bdd75d713dad02ff7e2c20033f03e43dbd22ba81b929
Instruction Fuzzy Hash: EAF04671E04348AFDF05DFBA9C4149EBBE8FB8A31471049B6F814E3302E6746E109295

Uniqueness

Uniqueness Score: -1.00%

Function 00428574, Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000,00000000), ref: 0042857E
LoadLibraryW.KERNEL32(00000000,00000000,004285C8,?,00000000,004285E6,?,00008000,00000000), ref: 004285AD

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 7d5e0b096f67028b0afde0de809f338d0dc3b19ddd235e3a899963c7483a3564
Instruction ID: ba6c2c3bca7b28f84dca392f2503051b26451b7b25f23774df3a0d956cb4e674
Opcode Fuzzy Hash: 7d5e0b096f67028b0afde0de809f338d0dc3b19ddd235e3a899963c7483a3564
Instruction Fuzzy Hash: DEF08970614704BFDB115F769C5245E7AECDB49B047524879F810E2591E67C5910C568

Uniqueness

Uniqueness Score: -1.00%

Function 00595F5C, Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 00595F8D
SetWindowTextW.USER32(?,00000000), ref: 00595FA3

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 91fcede389bec4c82ffd9f93201fd90124bb394032c227f2cb655a0a43e605eb
Instruction ID: ff3558f5c15b281acb91eceba176fa97a976ed26f3677dd23ea8bb63aa7fafa2
Opcode Fuzzy Hash: 91fcede389bec4c82ffd9f93201fd90124bb394032c227f2cb655a0a43e605eb
Instruction Fuzzy Hash: 67F0A7A13005006ADF16AA19C984BDA2A98AF85724F0800BBFD08DF287EBBC5D518366

Uniqueness

Uniqueness Score: -1.00%

Function 0046DAB4, Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 0046DABB
DestroyWindow.USER32(00000000,00000000,000000FC,?,?,005F320A,0064239B,?,?,?,?,00642E6B), ref: 0046DAC3

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window$DestroyLong
String ID:
API String ID: 2871862000-0
Opcode ID: d35388e099483fd212475e2ff9fa282c380b9acbf4dccf8539caaba4eac98094
Instruction ID: 506e97b04170959aeed06591a09ecd12f6433f5518fe485dd5721082e8543055
Opcode Fuzzy Hash: d35388e099483fd212475e2ff9fa282c380b9acbf4dccf8539caaba4eac98094
Instruction Fuzzy Hash: 2EC01211B0523016552831AD2CC18EF0188CC053A93100337B911D7153DA8D0E90429E

Uniqueness

Uniqueness Score: -1.00%

Function 00458704, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,00000000,0000000A,?,108B0065,00000000,0045A04F,?,00459F70,00000000,00459F88,?,0000FFA2,00000000,00000000), ref: 00458726

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 1183acad94fdf719573623a63ffe0335358e2b050e4974e49b94f60d7f29cbbc
Instruction ID: 985e3b26b8f4e7e320ae804b6e21d69bf7d2d1ac193ac384b9e879e60976bf14
Opcode Fuzzy Hash: 1183acad94fdf719573623a63ffe0335358e2b050e4974e49b94f60d7f29cbbc
Instruction Fuzzy Hash: 4801F771304300ABE700EF2ADC8292AB7EDDB89715721007EF900D7352DE799C09D668

Uniqueness

Uniqueness Score: -1.00%

Function 00420E28, Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,000000F0,000000F0,00000000,00000003,00000080,00000000,?,?,0043EB1C,0045F060,00000000,0045F0E0,?,?,0043EB1C), ref: 00420E77

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8754df3e58c03ab3d4fe9026f64b32e615f27e240739442f60d724f9d5a8b003
Instruction ID: 53ac6e735867e7e112aa44b46c71867779ed6cd52061a9ff1fa633369c989385
Opcode Fuzzy Hash: 8754df3e58c03ab3d4fe9026f64b32e615f27e240739442f60d724f9d5a8b003
Instruction Fuzzy Hash: 18E02BB2B105202AF730A5ED9C81B4B614E8796B75F1A0536F310E72E3C058DC018298

Uniqueness

Uniqueness Score: -1.00%

Function 00420E80, Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,?,?,0043EB1C,0045EFF5,00000000,0045F0E0,?,?,0043EB1C), ref: 00420EC9

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: df7142d94c8d07d2b21fcf3941a97737f83245ee7ac591e9399a067c15da750f
Instruction ID: bc36b6a2379a1f6e9adf1cf495550284c8e9474e14a8f90c49f5360281058299
Opcode Fuzzy Hash: df7142d94c8d07d2b21fcf3941a97737f83245ee7ac591e9399a067c15da750f
Instruction Fuzzy Hash: 7AE048E3B1152427F72065DD9C81FA751499741775F0A0135FB50DB3D1C155DC4182E4

Uniqueness

Uniqueness Score: -1.00%

Function 005A4C6C, Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,005A9B46,00000000,005A9B97,?,005A9D78), ref: 005A4C8B

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 1b23fc62eb9b4c0e085a39c0aeb01f6c3d8d61c8010127502ca9fede061f65e1
Instruction ID: 80131ff79e9f8e2c3db0ebbe4f64c9c41965386072eae7c777c286382d92210f
Opcode Fuzzy Hash: 1b23fc62eb9b4c0e085a39c0aeb01f6c3d8d61c8010127502ca9fede061f65e1
Instruction Fuzzy Hash: 1DE026717A430132F32421944C23B7E160AA7C5B20FE4C83977C4DD2D6EAF99C5586AA

Uniqueness

Uniqueness Score: -1.00%

Function 005A2EF8, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,005A2F3E,?,00000000,00000000,?,005A2F8E,00000000,005EA295,00000000,005EA2B6,?,00000000,00000000,00000000), ref: 005A2F21

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d625db2dbbb9f710865f164fde3783a4dc9d32dd40f8c3c6d9aa2fc693bde109
Instruction ID: 8c1eca4c0e02f6108c6d1fe153df7d3888180d0dffd47cc92d7232446bf6e83b
Opcode Fuzzy Hash: d625db2dbbb9f710865f164fde3783a4dc9d32dd40f8c3c6d9aa2fc693bde109
Instruction Fuzzy Hash: EBE09231304308AFD701EAB5CD5395DB7ADEB8AB00F910475F600E3652D6B86E008418

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCB0, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 0040BCCE

Part of subcall function 0040CF3C: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040CFF6,?,?,00000000), ref: 0040CF78
Part of subcall function 0040CF3C: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040CFF6,?,?,00000000), ref: 0040CFC9

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: fb461025cbe681df2a143f1f7a0c40bf3d41b7aceca76d0f144364663fdcf8d6
Instruction ID: 1f5600aeeeef4e32b1f9c7225543f83e9437731e2d57e16c847b264f9fd5aaae
Opcode Fuzzy Hash: fb461025cbe681df2a143f1f7a0c40bf3d41b7aceca76d0f144364663fdcf8d6
Instruction Fuzzy Hash: 29E039B1A003109BDB10DF58C8C1A5737D8AB08714F004A6AAC24EF386D374CD1087D9

Uniqueness

Uniqueness Score: -1.00%

Function 00635E53, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(?,00635EA6,?,00000000,00000000,?,00641232,00000006,?,00000000,006417E8,?,00000000,006418A7), ref: 00635E99

Strings

Common Files, xrefs: 00635D6F
cmd.exe, xrefs: 00635EC4
CommonFilesDir, xrefs: 00635D38, 00635DB4
COMMAND.COM, xrefs: 00635EE5
ProgramFilesDir, xrefs: 00635CFE, 00635D85
\Program Files, xrefs: 00635D25
Failed to get path of 64-bit Program Files directory, xrefs: 00635DA7
Failed to get path of 64-bit Common Files directory, xrefs: 00635DD6
SystemDrive, xrefs: 00635C9D

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FreeTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 734271698-544719455
Opcode ID: d6cc94357e9b4d482e3f780e28921c765618eee60dc83b54c62dd7b943fc5ee4
Instruction ID: 7ffc6370bda443bc92fef2a0e313934ca25d4b777612dd4e68e9b9fc68387764
Opcode Fuzzy Hash: d6cc94357e9b4d482e3f780e28921c765618eee60dc83b54c62dd7b943fc5ee4
Instruction Fuzzy Hash: B9E09230704B04BFE7118BB19C12E1A77A9E789B00F624475F901D3580D6389E109654

Uniqueness

Uniqueness Score: -1.00%

Function 005A2F94, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,005EA4C9,00000000,005EA4E2,?,?,00000000), ref: 005A2F9F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3fc13b6c4635f6ae6ecc1daee0bb61bb569768daf146123bafa4b6bad18ffcbd
Instruction ID: fc3c4eed84c30f19a1c441d424a5b67955dd1178da1cbcafa755cc6f6b03dff3
Opcode Fuzzy Hash: 3fc13b6c4635f6ae6ecc1daee0bb61bb569768daf146123bafa4b6bad18ffcbd
Instruction Fuzzy Hash: 48D080F12112001FEE14A6BD1DC735D45946B97335F144B66F665E21E3D7399CD35024

Uniqueness

Uniqueness Score: -1.00%

Function 005A2F4C, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,005AB367,00000000), ref: 005A2F57

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0a0f09deebbd281496e0abfd8faafcafab9297cd4a4e6d6e51855e5059c14469
Instruction ID: 8eea6359f5587f00b947eba6570d919262773cccbea40a920b8d3036fa88f985
Opcode Fuzzy Hash: 0a0f09deebbd281496e0abfd8faafcafab9297cd4a4e6d6e51855e5059c14469
Instruction Fuzzy Hash: 83C08CB13212001AAE28A5BD1DC724D0288D90A6387244A6AF028E21D3D239D8622024

Uniqueness

Uniqueness Score: -1.00%

Function 00411FE4, Relevance: 1.5, APIs: 1, Instructions: 14synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,00000001,00000000,?,00642877,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00642B9B,?,?,00000000), ref: 00411FFA

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction ID: 17771853574b2dc6cb8315a9c587b9dce1d3e72867bd59f58d8409b472a021cf
Opcode Fuzzy Hash: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction Fuzzy Hash: B1C01273150248AF8B00EEA9CC05D9B33DC5718609F008419F518C7110C239E5908B60

Uniqueness

Uniqueness Score: -1.00%

Function 004216CC, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(00000000,?,006420A6,00000000,006422B3,?,?,00000005,00000000,006422EC,?,?,00000000), ref: 004216D7

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: b0d6698c2dcac5c5f0ae111c9658734ca8c85f2357247c35c1432fb6bd6b82a1
Instruction ID: 564d134ef7185f85f8d01be3fce57125d53e0ced79d182862342ca5686891228
Opcode Fuzzy Hash: b0d6698c2dcac5c5f0ae111c9658734ca8c85f2357247c35c1432fb6bd6b82a1
Instruction Fuzzy Hash: ADB012F37302408ADE0079FE0CC1A0D00CC950D60E7100C3FB415D3103D47EC8540118

Uniqueness

Uniqueness Score: -1.00%

Function 004285CF, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,004285ED), ref: 004285E0

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 694ce845132877454baa2e6b3012364acd93b9efc57970288032cec8c680be07
Instruction ID: 568c60eda5aa1572bc2e1142576596c1e9a0f01cb60d8405de23d4eee8032556
Opcode Fuzzy Hash: 694ce845132877454baa2e6b3012364acd93b9efc57970288032cec8c680be07
Instruction Fuzzy Hash: 61B09B7670C2047DEB05D6E5791156C63D4D7C47103E1487BF414C2540D97CA450C618

Uniqueness

Uniqueness Score: -1.00%

Function 00636878, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00642378,00000000,00642387,?,?,?,?,?,00642E6B), ref: 0063688E

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f32a72f60d711907929f94d09a49bc4b41de752ae0866165be8e13c42a4fe9b3
Instruction ID: c016c28d6e174527514e8dcd2413324d0cd3dc8fe68db40f6dac7c3ea7217bf6
Opcode Fuzzy Hash: f32a72f60d711907929f94d09a49bc4b41de752ae0866165be8e13c42a4fe9b3
Instruction Fuzzy Hash: 4FC002B0910B00AEC7E4EB79EC687A137E6B70830AF107829B104C3260EB749480EB10

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8C4, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040E8C8

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 3c697633d840bb24647ac05e8ba59606fced48aa54a110b736518492aea7a936
Instruction ID: 47ab257af6e364695ea890f9b43c82e37ccfc4e8ddd737aab863078b62403aa0
Opcode Fuzzy Hash: 3c697633d840bb24647ac05e8ba59606fced48aa54a110b736518492aea7a936
Instruction Fuzzy Hash: 0DA012108084001AC404BB194C4340F39C45941514FC40264745CB56C2E61A866403DB

Uniqueness

Uniqueness Score: -1.00%

Function 0046D864, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,?,?,004F335B,004F58DC,?,?,?,00000000,?,0058A9BB), ref: 0046D882

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8b061f331fd42d607532db1b467d7515908698bc866769bdc05ba9cd2a7e7e49
Instruction ID: bfd231d992f2bcfde4f8b5cc6a270b98dceb088bb630ada5516c6f1a4b212f3e
Opcode Fuzzy Hash: 8b061f331fd42d607532db1b467d7515908698bc866769bdc05ba9cd2a7e7e49
Instruction Fuzzy Hash: E7111874A403059BD710EF19C881B82FBE5EF98350F14C53AE9688B386E374E915CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403C6C, Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,000001A3,00404283,000000FF,00404828,00000000,0040D8EF,00000000,0040DDFD,00000000,0040E0BF,00000000), ref: 00403C83

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f76ec2e496c5b49282b10548a05cc944a81f0939acac8f67f311ffb2ad1ec239
Instruction ID: 197183dc905841a21b02d7182249454c67855fd1ed42545ff938eb58c327bd08
Opcode Fuzzy Hash: f76ec2e496c5b49282b10548a05cc944a81f0939acac8f67f311ffb2ad1ec239
Instruction Fuzzy Hash: 82F0AFF2B453115FE754DF78AD407027BE6E70435AF1141BEE909EB798DBB098418788

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0060D02C, Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 187pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0060D094
QueryPerformanceCounter.KERNEL32(00000000,00000000,0060D327,?,?,00000000,00000000,?,0060DD26,?,00000000,00000000), ref: 0060D09D
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0060D0A7
GetCurrentProcessId.KERNEL32(?,00000000,00000000,0060D327,?,?,00000000,00000000,?,0060DD26,?,00000000,00000000), ref: 0060D0B0
CreateNamedPipeW.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0060D126
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0060D134
CreateFileW.KERNEL32(00000000,C0000000,00000000,00652F64,00000003,00000000,00000000,00000000,0060D2E3,?,00000000,40080003,00000006,00000001,00002000,00002000), ref: 0060D17C
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0060D2D2,?,00000000,C0000000,00000000,00652F64,00000003,00000000,00000000,00000000,0060D2E3), ref: 0060D1B5

Part of subcall function 005A3B4C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005A3B5F

CreateProcessW.KERNEL32 ref: 0060D25E
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0060D294
CloseHandle.KERNEL32(000000FF,0060D2D9,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0060D2CC

Part of subcall function 005EAE9C: GetLastError.KERNEL32(00000000,005EBBB2,00000005,00000000,005EBBDA,?,?,0065A16C,?,00000000,00000000,00000000,?,006427AF,00000000,006427CA), ref: 005EAE9F

Strings

Helper process PID: %u, xrefs: 0060D2B1
i, xrefs: 0060D211
CreateProcess, xrefs: 0060D267
CreateNamedPipe, xrefs: 0060D144
D, xrefs: 0060D1D7
Cannot utilize 64-bit features on this version of Windows, xrefs: 0060D075
CreateFile, xrefs: 0060D18A
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 0060D0FC
Starting 64-bit helper process., xrefs: 0060D061
64-bit helper EXE wasn't extracted, xrefs: 0060D088
helper %d 0x%x, xrefs: 0060D23D
SetNamedPipeHandleState, xrefs: 0060D1BE

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: f091b4c5318b2b8ffab42f6e174357930a688812a2595e220192bf419fc50ec0
Instruction ID: b2bc1b4cfb105523b6febe2a5c2bb6cdffe5ec4bcfb11564dc467e890829e451
Opcode Fuzzy Hash: f091b4c5318b2b8ffab42f6e174357930a688812a2595e220192bf419fc50ec0
Instruction Fuzzy Hash: A8714170A403449EEB15EFB9CC45B9EBBB9AF09704F1045A9F508EB282D7749940CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0062FC50, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 0062FA6C: GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 0062FA98
Part of subcall function 0062FA6C: GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0062FAB1
Part of subcall function 0062FA6C: CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0062FADB
Part of subcall function 0062FA6C: CloseHandle.KERNEL32(00000000), ref: 0062FAF9

Part of subcall function 0062FB7C: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,0062FC0D,?,00000097,?,?,0062FC87,00000000,0062FD9F,?,?,00000001), ref: 0062FBAB

ShellExecuteExW.SHELL32(0000003C), ref: 0062FCD7
GetLastError.KERNEL32(0000003C,00000000,0062FD9F,?,?,00000001), ref: 0062FCE0
MsgWaitForMultipleObjects.USER32 ref: 0062FD2D
GetExitCodeProcess.KERNEL32 ref: 0062FD53
CloseHandle.KERNEL32(00000000,0062FD84,00000000,00000000,000000FF,000004FF,00000000,0062FD7D,?,0000003C,00000000,0062FD9F,?,?,00000001), ref: 0062FD77

Strings

MsgWaitForMultipleObjects, xrefs: 0062FD3C
<, xrefs: 0062FC96
runas, xrefs: 0062FCA4
ShellExecuteEx returned hProcess=0, xrefs: 0062FD01
ShellExecuteEx, xrefs: 0062FCF1
GetExitCodeProcess, xrefs: 0062FD5C

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Handle$CloseFile$AttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 254331816-221126205
Opcode ID: ed860805f37d688687dcf54d7d08fea055ef2f575ad12152dfba573c8ec19098
Instruction ID: 0b403eb0ef8cc9205116744ff4da66d86d777c4ea0c346c4558032144fd31bdd
Opcode Fuzzy Hash: ed860805f37d688687dcf54d7d08fea055ef2f575ad12152dfba573c8ec19098
Instruction Fuzzy Hash: 1E319070A00A19AFDF10EFF5E882A9DBAB9EF48314F50093AF514E7281D77499408F55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C630, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041AE20,?,?), ref: 0040C64D
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040C65E
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041AE20,?,?), ref: 0040C75E
FindClose.KERNEL32(?,?,?,kernel32.dll,0041AE20,?,?), ref: 0040C770
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041AE20,?,?), ref: 0040C77C
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041AE20,?,?), ref: 0040C7C1

Strings

kernel32.dll, xrefs: 0040C648
\, xrefs: 0040C78E
GetLongPathNameW, xrefs: 0040C658

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 4773db546d1690116369375d742ab2497b584d83e0c4ddfbfa3afb5929d1cbd5
Instruction ID: 39d58d8c64e7cc71e6dd469938ce122afd0884a6e0bc7c1439aad5226bf35ab4
Opcode Fuzzy Hash: 4773db546d1690116369375d742ab2497b584d83e0c4ddfbfa3afb5929d1cbd5
Instruction Fuzzy Hash: 98418172A00619DBCB10EBA4C8C5ADEB3B9AB44314F1486BAE505F72C1E7789E45CE49

Uniqueness

Uniqueness Score: -1.00%

Function 00630418, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 159windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 0063046D
GetWindowLongW.USER32(?,000000F0), ref: 0063048A
GetWindowLongW.USER32(?,000000EC), ref: 006304AF

Part of subcall function 005899B4: IsWindow.USER32(?), ref: 005899C2
Part of subcall function 005899B4: EnableWindow.USER32(?,000000FF), ref: 005899D1

GetActiveWindow.USER32 ref: 0063057B
SetActiveWindow.USER32(00000005,006305E3,006305F9,?,?,000000EC,?,000000F0,?,00000000,?,00000000), ref: 006305CC

Strings

`, xrefs: 00630443
(^R, xrefs: 0063050D

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window$ActiveLong$EnableIconic
String ID: (^R$`
API String ID: 4222481217-3475214697
Opcode ID: d6ce6e83afc5c20cce439eba08a63f8cd8a93f9faca1daa21346161357407ef8
Instruction ID: b313e5acbe8b388c5dbcfe40345229c2ecffaaf30a1e3738cb61cf76762f81f7
Opcode Fuzzy Hash: d6ce6e83afc5c20cce439eba08a63f8cd8a93f9faca1daa21346161357407ef8
Instruction Fuzzy Hash: 75515674A00349AFEB00DFA9D994ADEBBF5FB49310F15416AE804EB352D7349A45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 005ED36C, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 005ED37C
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 005ED382
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 005ED39B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 005ED3C2
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 005ED3C7
ExitWindowsEx.USER32(00000002,00000000), ref: 005ED3D8

Strings

SeShutdownPrivilege, xrefs: 005ED394

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 8e6f6d31be450e79406add97cb0369e5f722a79e16e2cc6878969e3b8d5dd894
Instruction ID: b04b89c09f7ddeef72ec2ec8f60e22db0734ab55fc4febef560a69b91557df66
Opcode Fuzzy Hash: 8e6f6d31be450e79406add97cb0369e5f722a79e16e2cc6878969e3b8d5dd894
Instruction Fuzzy Hash: 15F096706443817AE614AA768D47FAB6598BB48B09F500C19FA81D90C2D7E9C5444337

Uniqueness

Uniqueness Score: -1.00%

Function 00642484, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,006425C1,?,0065A16C,?,?,00642776,00000000,006427CA,?,00000000,00000000,00000000), ref: 006424D5
SetFileAttributesW.KERNEL32(00000000,00000010), ref: 00642558
FindNextFileW.KERNEL32(000000FF,?,00000000,00642594,?,00000000,?,00000000,006425C1,?,0065A16C,?,?,00642776,00000000,006427CA), ref: 00642570
FindClose.KERNEL32(000000FF,0064259B,00642594,?,00000000,?,00000000,006425C1,?,0065A16C,?,?,00642776,00000000,006427CA), ref: 0064258E

Strings

isRS-, xrefs: 006424F5
isRS-???.tmp, xrefs: 006424BD

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: a309500b51529c32fce40da19076d287f010eb58f56449f56aa4c1946b5ad8af
Instruction ID: 0e370502df9114c3f3335e4e6ae3f483510ce7cd5b383a1c8210de74ee0ad061
Opcode Fuzzy Hash: a309500b51529c32fce40da19076d287f010eb58f56449f56aa4c1946b5ad8af
Instruction Fuzzy Hash: 0531D670A0061D9EDB14DF65CCA56DEB7F9DB88304F6145FAB804E3291EA389E408E18

Uniqueness

Uniqueness Score: -1.00%

Function 005A57A4, Relevance: 9.1, APIs: 6, Instructions: 98windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 005A57E9
GetWindowLongW.USER32(?,000000F0), ref: 005A5806
GetWindowLongW.USER32(?,000000EC), ref: 005A582B
GetActiveWindow.USER32 ref: 005A5839
MessageBoxW.USER32(00000000,00000000,?,-0000002D), ref: 005A5866
SetActiveWindow.USER32(?,005A5894,-0000002D,00000000,005A588D,?,?,000000EC,?,000000F0,?,00000000,005A58CA,?,?,00000000), ref: 005A5887

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: 54feb3ad70b066b216c2defb355d89d5df0c87f386d8783efc889e4468b28595
Instruction ID: a60e4e042af9b303bbe8633358de159b1346189e86fd6f513409704253803ce5
Opcode Fuzzy Hash: 54feb3ad70b066b216c2defb355d89d5df0c87f386d8783efc889e4468b28595
Instruction Fuzzy Hash: FA319074A04705AFDB01EF68C945EAD7BE9FB4A750F2144A5F400E7361EA389E40DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00610778, Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 214COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00610A3A,?,?,?,?,00000005,00000000,00000000,?,?,00611E15,00000000,00000000,?,00000000), ref: 006108EE

Strings

Failed to strip read-only attribute., xrefs: 006108D3
Stripped read-only attribute., xrefs: 006108C7
.hlp, xrefs: 006107B5
.chw, xrefs: 00610833
Failed to delete the file; it may be in use (%d)., xrefs: 006109D1
Deleting file: %s, xrefs: 0061088B
The file appears to be in use (%d). Will delete on restart., xrefs: 00610937
.gid, xrefs: 006107CE
.fts, xrefs: 006107F2
.lnk, xrefs: 00610859
.chm, xrefs: 0061081A

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: ad6138e970db2b966c8bbf81e1069841e701d7c9850f3f517389a1b8a9348dbe
Instruction ID: e6cd71c5a8f7bcaddfe72b3acef8a69568e07205ef0f7ae028da9a62bf90c54a
Opcode Fuzzy Hash: ad6138e970db2b966c8bbf81e1069841e701d7c9850f3f517389a1b8a9348dbe
Instruction Fuzzy Hash: B671B630B043495BEF05EF68C8567EE7BA6AF89700F184429F501EB382DAB4DDC587A5

Uniqueness

Uniqueness Score: -1.00%

Function 006427D8, Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 260COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00642B9B,?,?,00000000,?,00000000,00000000,?,0064307E,00000000,00643088,?,00000000), ref: 0064285F
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00642B9B,?,?,00000000,?,00000000,00000000), ref: 00642885
MsgWaitForMultipleObjects.USER32 ref: 006428A6
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00642B9B,?,?,00000000,?,00000000), ref: 006428BB

Part of subcall function 005A36A0: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005A3735,?,?,?,00000001,?,005EE002,00000000,005EE06D), ref: 005A36D5

Strings

/REGU, xrefs: 00642832
/REG, xrefs: 0064280E
Inno-Setup-RegSvr-Mutex, xrefs: 00642869
.msg, xrefs: 006428DE
.lst, xrefs: 006428F8
Setup, xrefs: 0064284A

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ShowWindow$FileModuleMultipleNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 66301061-3672972446
Opcode ID: ac06f2c3c72c101507e7b7ef73b103babe9dcfcec9277c9e937e877dc9e32d37
Instruction ID: 110cf92351643aaa4ed423b98191ca0c91b0a181f731d74a9568e570e5a22ada
Opcode Fuzzy Hash: ac06f2c3c72c101507e7b7ef73b103babe9dcfcec9277c9e937e877dc9e32d37
Instruction Fuzzy Hash: B791E530A042069FDB11EFA4C8A6BEEBBF6FB49304FA14465F900A7791DB749D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 005EC4DC, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 253registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A4104: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005A47DE,?,00000000,?,005A477E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005A47DE), ref: 005A4120

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,00000000,005EC77A,?,?,00000003,00000000,00000000,005EC7BE), ref: 005EC5F9

Part of subcall function 005A4C6C: FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,005A9B46,00000000,005A9B97,?,005A9D78), ref: 005A4C8B

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,005EC6B8,?,?,00000000,00000000,?,00000000,?,00000000), ref: 005EC67A
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,005EC6B8,?,?,00000000,00000000,?,00000000,?,00000000), ref: 005EC6A1

Strings

RegOpenKeyEx, xrefs: 005EC575
, xrefs: 005EC56C
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 005EC552
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 005EC519

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 709410a71862da4a1ab22660b2f13bbfb0c613db31a7ce6eb402ae0c01e4d2ef
Instruction ID: db115f0f08ccc932d76a1897e8643d661f73b45f3d1e9fb90d8d7ef6fbe39c1c
Opcode Fuzzy Hash: 709410a71862da4a1ab22660b2f13bbfb0c613db31a7ce6eb402ae0c01e4d2ef
Instruction Fuzzy Hash: CE916371E042499FDB14DBA9C892BEEBFB9FB48304F10042AF540E7241D774A946CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0060E978, Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 162registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0060EB81,?,0060E678,?,00000000,00000000,00000000,?,?,0060EDEC,00000000), ref: 0060EA25
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0060EB81,?,0060E678,?,00000000,00000000,00000000,?,?,0060EDEC,00000000), ref: 0060EA8F
RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,00000001,00000000,00000000,0060EB81,?,0060E678,?,00000000,00000000,00000000,?), ref: 0060EAF6

Strings

v2.0.50727, xrefs: 0060EA81
v4.0.30319, xrefs: 0060EA17
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 0060EAAC
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 0060E9DB
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0060EA45
.NET Framework not found, xrefs: 0060EB42
v1.1.4322, xrefs: 0060EAE8
.NET Framework version %s not found, xrefs: 0060EB2E

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Close
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 3535843008-446240816
Opcode ID: c32439bf22504c1c4f4f6f3c143e30a9dd3855db37e27ec8b70e4ab1d410b94b
Instruction ID: 39e331217aeb24eabde49a6d874fa1452d3dc7d56d65f24c81d343316d547005
Opcode Fuzzy Hash: c32439bf22504c1c4f4f6f3c143e30a9dd3855db37e27ec8b70e4ab1d410b94b
Instruction Fuzzy Hash: C9512930B441655BDF08DBA8C861BFE7BB7EF89301F14096AE541A73D1C77A9A05CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0060D5EC, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0060D623
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0060D63F
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 0060D64D
GetExitCodeProcess.KERNEL32 ref: 0060D65E
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0060D6A5
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0060D6C1

Strings

Helper process exited with failure code: 0x%x, xrefs: 0060D68B
Helper process exited, but failed to get exit code., xrefs: 0060D697
Helper isn't responding; killing it., xrefs: 0060D62F
Stopping 64-bit helper process. (PID: %u), xrefs: 0060D615
Helper process exited., xrefs: 0060D66D

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 1de598a6b0e1c7d00574f8a4817e03ac1f8f7b6fcba575226b05553fd33cef59
Instruction ID: 454b6500e2c9d163297ce36385c005d39dba8bff4028d83027d05e9be869f4a4
Opcode Fuzzy Hash: 1de598a6b0e1c7d00574f8a4817e03ac1f8f7b6fcba575226b05553fd33cef59
Instruction Fuzzy Hash: 6B2180706547015BD724EBBDC44979BBBE69F48344F008D2DB68EC7291D779E8808B16

Uniqueness

Uniqueness Score: -1.00%

Function 00640AD8, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 145fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005EB3C0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005EB4FB), ref: 005EB4AB
Part of subcall function 005EB3C0: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005EB4FB), ref: 005EB4BB

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,00640CC6), ref: 00640B5B
SetFileAttributesW.KERNEL32(00000000,00000080,00000000,00000000,00000000,00000000,00640CC6), ref: 00640B82
SetWindowLongW.USER32 ref: 00640BBC
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00640C8F,?,?,000000FC,006401D4,00000000,?,00000000), ref: 00640BF1
MsgWaitForMultipleObjects.USER32 ref: 00640C65
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00640C8F,?,?,000000FC,006401D4,00000000), ref: 00640C73

Part of subcall function 005EB8B8: WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 005EB99E

DestroyWindow.USER32(?,00640C96,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00640C8F,?,?,000000FC,006401D4,00000000,?), ref: 00640C89

Strings

STATIC, xrefs: 00640BA2
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00640C20

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileWindow$CloseHandle$AttributesCopyCreateDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1779715363-2312673372
Opcode ID: e7c0a3158080f08e412c6a025787e5d8f332e08b6d5e4f44b35497bd71173ac9
Instruction ID: d5e2afc5af2165a232b2dde078bf647205854a6f10d5337c80bb9168f0ebd674
Opcode Fuzzy Hash: e7c0a3158080f08e412c6a025787e5d8f332e08b6d5e4f44b35497bd71173ac9
Instruction Fuzzy Hash: 5F415F70A00218EFEB00EFB5CD92ADEBBF9EB09714F114569F600E7291D7759A008B64

Uniqueness

Uniqueness Score: -1.00%

Function 005968D8, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00597E58: GetActiveWindow.USER32 ref: 00597E7F
Part of subcall function 00597E58: GetLastActivePopup.USER32(?), ref: 00597E94

MonitorFromWindow.USER32(00000000,00000002), ref: 00596911
MonitorFromWindow.USER32(?,00000002), ref: 00596925
GetMonitorInfoW.USER32 ref: 00596944
GetWindowRect.USER32 ref: 00596957
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,?,00000000,00000028,?,00000002,?,?,00000000), ref: 00596992
MessageBoxW.USER32(00000000,00000000,?,?), ref: 005969D1
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,00596A4A,?,00000002,?,?,00000000), ref: 00596A24

Part of subcall function 005899B4: IsWindow.USER32(?), ref: 005899C2
Part of subcall function 005899B4: EnableWindow.USER32(?,000000FF), ref: 005899D1

SetActiveWindow.USER32(00000000,00596A4A,?,00000002,?,?,00000000), ref: 00596A35

Strings

(, xrefs: 00596935

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window$ActiveMonitor$From$EnableInfoLastMessagePopupRect
String ID: (
API String ID: 2800294577-3887548279
Opcode ID: 93439f5cc7ba727cc7d97b424d465ef9b60ac03c4973447e8edcbb0b2ad04a1c
Instruction ID: 4dd609e7ed9c10f2a39831ec99a0677e2ecea9c4a8af3539202c6e4dd4599a2a
Opcode Fuzzy Hash: 93439f5cc7ba727cc7d97b424d465ef9b60ac03c4973447e8edcbb0b2ad04a1c
Instruction Fuzzy Hash: AB41F975E00209AFDF04DBA9CD96FEEBBB9FB48304F548469F500AB381DA746D408B54

Uniqueness

Uniqueness Score: -1.00%

Function 0060D89C, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124pipeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000,00000000,0060DA7F,?,00000000,0060DADA,?,?,00000000,00000000), ref: 0060D8F9
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0060DA14,?,00000000,000000FF,00000000,00000000,00000000,0060DA7F), ref: 0060D956
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0060DA14,?,00000000,000000FF,00000000,00000000,00000000,0060DA7F), ref: 0060D963
MsgWaitForMultipleObjects.USER32 ref: 0060D9AF
GetOverlappedResult.KERNEL32(?,?,00000000,000000FF,0060D9ED,00000000,00000000), ref: 0060D9D9
GetLastError.KERNEL32(?,?,00000000,000000FF,0060D9ED,00000000,00000000), ref: 0060D9E0

Part of subcall function 005EAE9C: GetLastError.KERNEL32(00000000,005EBBB2,00000005,00000000,005EBBDA,?,?,0065A16C,?,00000000,00000000,00000000,?,006427AF,00000000,006427CA), ref: 005EAE9F

Strings

TransactNamedPipe, xrefs: 0060D96F
CreateEvent, xrefs: 0060D907

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 587abc3039294ab8be615838be7e2b3339d4a2d9f7e7a7c65fe5873f3d42b28e
Instruction ID: cc40f01ca4d4471f174cde47d1b1fd116972b229995c538558590d9fa653ab81
Opcode Fuzzy Hash: 587abc3039294ab8be615838be7e2b3339d4a2d9f7e7a7c65fe5873f3d42b28e
Instruction Fuzzy Hash: 74417B74A40208AFDB15DFD9CD81F9EBBB9FB09310F1142A5FA00E72D1D6749A40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4EC, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00656C14,00000000,0040C5F0,?,?,?,00000000,?,0040CED0,00000000,0040CF2F,?,?,00000000,00000000,00000000), ref: 0040C50A
LeaveCriticalSection.KERNEL32(00656C14,00656C14,00000000,0040C5F0,?,?,?,00000000,?,0040CED0,00000000,0040CF2F,?,?,00000000,00000000), ref: 0040C52E
LeaveCriticalSection.KERNEL32(00656C14,00656C14,00000000,0040C5F0,?,?,?,00000000,?,0040CED0,00000000,0040CF2F,?,?,00000000,00000000), ref: 0040C53D
IsValidLocale.KERNEL32(00000000,00000002,00656C14,00656C14,00000000,0040C5F0,?,?,?,00000000,?,0040CED0,00000000,0040CF2F), ref: 0040C54F
EnterCriticalSection.KERNEL32(00656C14,00000000,00000002,00656C14,00656C14,00000000,0040C5F0,?,?,?,00000000,?,0040CED0,00000000,0040CF2F), ref: 0040C5AC
LeaveCriticalSection.KERNEL32(00656C14,00656C14,00000000,00000002,00656C14,00656C14,00000000,0040C5F0,?,?,?,00000000,?,0040CED0,00000000,0040CF2F), ref: 0040C5D5

Strings

en-US,en,, xrefs: 0040C51A, 0040C5C1

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-US,en,
API String ID: 975949045-3579323720
Opcode ID: 46dfa2c390dfd9fcddc3d7a3d519c078bf4b27f4af89702944140c56ae647f6d
Instruction ID: d7439257cb545fff3ac83513a8b3620a4b66b1634b2132e293977f8023978c7a
Opcode Fuzzy Hash: 46dfa2c390dfd9fcddc3d7a3d519c078bf4b27f4af89702944140c56ae647f6d
Instruction Fuzzy Hash: 8D215AA4340210F6D711BB7A8C4261E359ADB89705F90867FB480B76C2DA7C9D45C7AF

Uniqueness

Uniqueness Score: -1.00%

Function 0060BFDC, Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,0060C0F6,?,?,?,00000000,00000000,00000000,00000000,00000000,?,006110ED,00000000,00611101), ref: 0060C002

Part of subcall function 00412174: GetProcAddress.KERNEL32(?,?), ref: 0041219E

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0060C046

Part of subcall function 005EAE9C: GetLastError.KERNEL32(00000000,005EBBB2,00000005,00000000,005EBBDA,?,?,0065A16C,?,00000000,00000000,00000000,?,006427AF,00000000,006427CA), ref: 005EAE9F

Strings

GetProcAddress, xrefs: 0060C015
ITypeLib::GetLibAttr, xrefs: 0060C06E
LoadTypeLib, xrefs: 0060C051
OLEAUT32.DLL, xrefs: 0060BFFD
UnRegisterTypeLib, xrefs: 0060BFF8
UnRegisterTypeLib, xrefs: 0060C0A4

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 9f5fe79e6db05353f538a1eebee7ab1e996da728d0d1e3da66a18af11cc71638
Instruction ID: c2cb6c9ee0fbc8b90987324f6613d756fd54a5fa1b02bc5094d3a695c3bf0470
Opcode Fuzzy Hash: 9f5fe79e6db05353f538a1eebee7ab1e996da728d0d1e3da66a18af11cc71638
Instruction Fuzzy Hash: B32171B1640105AFDB18EFAACC46D6B77FEEB8975070146A5F500D7392EA75EC01C760

Uniqueness

Uniqueness Score: -1.00%

Function 005A46E4, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,005A47DE,?,00000000), ref: 005A470B

Part of subcall function 00412174: GetProcAddress.KERNEL32(?,?), ref: 0041219E

RegCloseKey.ADVAPI32(00000001,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005A47DE,?,00000000), ref: 005A475E

Strings

GetUserDefaultUILanguage, xrefs: 005A4701
.DEFAULT\Control Panel\International, xrefs: 005A4735
Control Panel\Desktop\ResourceLocale, xrefs: 005A476D
Locale, xrefs: 005A474D
kernel32.dll, xrefs: 005A4706

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 38d245925cd77707b595921afbc790aa8a96741c4ef4a929910e425defbdce3e
Instruction ID: ffaeb6297c0d62a825f7238d28ed2e408fbbe1f37f8c66c39d9c2991aa99af75
Opcode Fuzzy Hash: 38d245925cd77707b595921afbc790aa8a96741c4ef4a929910e425defbdce3e
Instruction Fuzzy Hash: F8214134A00249ABDB00EAF5DD46A9E7BE9FBC7704F604875E500E7281EBF89A41DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0060C480, Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 005A3B4C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005A3B5F

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,0060C630,00000000, /s ",0065A16C,regsvr32.exe",?,0060C630), ref: 0060C59E

Strings

Spawning 64-bit RegSvr32: , xrefs: 0060C519
/s ", xrefs: 0060C4F7
0x%x, xrefs: 0060C5C1
/u, xrefs: 0060C4EA
CreateProcess, xrefs: 0060C590
regsvr32.exe", xrefs: 0060C4CF
D, xrefs: 0060C554
Spawning 32-bit RegSvr32: , xrefs: 0060C533

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 40bd89ddee4e9229e537327ee8d764d2d56849d65a32e5dfed440d7bb9103ebc
Instruction ID: 279bcd7635ff1aefc0996df8e2b67d7a0723741da229aafdca0a884a1ab81807
Opcode Fuzzy Hash: 40bd89ddee4e9229e537327ee8d764d2d56849d65a32e5dfed440d7bb9103ebc
Instruction Fuzzy Hash: FE415370A503489BDB14EFE5D882BDEBBBABF48314F50417EA504A7282DB74AE05CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004083A4, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?,00408576,0040559F,004055E6,?,?,004055FF), ref: 004083DD
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?,00408576,0040559F,004055E6,?,?), ref: 004083E3
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?,?), ref: 004083FE
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040845C,?,?), ref: 00408404

Strings

DCe, xrefs: 004083C2
Runtime error at 00000000, xrefs: 004083D6, 0040841B
Error, xrefs: 00408416

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandleWrite
String ID: DCe$Error$Runtime error at 00000000
API String ID: 3320372497-3118018461
Opcode ID: 13ce4a5f80a4d2b30842d409f903e3885f5d800d9945ef1b546b75d07238ec8f
Instruction ID: db3e682c4185ed60903732901cf8b317f543b65e566f1b916b3a1051628e4cb0
Opcode Fuzzy Hash: 13ce4a5f80a4d2b30842d409f903e3885f5d800d9945ef1b546b75d07238ec8f
Instruction Fuzzy Hash: 28F022A064430079E720FB525C0BF6A361DA340F2BF10457FB1A0795E2DEFA08C4836D

Uniqueness

Uniqueness Score: -1.00%

Function 0040430C, Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,0040D848,0040D8AE,?,00000000,?,?,0040DBD1,00000000,?,00000000,0040E0D2,00000000), ref: 004043A2
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,0040D848,0040D8AE,?,00000000,?,?,0040DBD1,00000000,?,00000000,0040E0D2), ref: 004043BC

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1016a958b786f1fdd381e3269713c88165e87144ef6066025b2b75cb69c11a4f
Instruction ID: 1aecba4b52118cb35790b111e3d5a1c67d58f87a9ec508f8fd78de97f3545b00
Opcode Fuzzy Hash: 1016a958b786f1fdd381e3269713c88165e87144ef6066025b2b75cb69c11a4f
Instruction Fuzzy Hash: 8F71E2716043004BE715DF69C984B16BBE8AF8531AF14C2BFE944AB3D2D7789941CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0060FD64, Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0060FEEA,?,00000000,?), ref: 0060FE2C

Part of subcall function 005EBFB4: FindClose.KERNEL32(000000FF,005EC0A9), ref: 005EC098

Strings

Deleting directory: %s, xrefs: 0060FDB3
Failed to delete directory (%d). Will retry later., xrefs: 0060FE45
Failed to strip read-only attribute., xrefs: 0060FDFA
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 0060FE06
Stripped read-only attribute., xrefs: 0060FDEE
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 0060FEA3
Failed to delete directory (%d)., xrefs: 0060FEC4

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: d999e69477626a0a15c09723bca9127b35e565f29ca8611823951ad673c067a9
Instruction ID: fb8e7fb15c6259bd85cfdc6f3f4ee4436f7004990c8006c962aed4e647bcc0ca
Opcode Fuzzy Hash: d999e69477626a0a15c09723bca9127b35e565f29ca8611823951ad673c067a9
Instruction Fuzzy Hash: 2E410730A442099BDB28EBBDC4093EF7AEBAF85300F14443AA501D77D2DBB88E458752

Uniqueness

Uniqueness Score: -1.00%

Function 0059609C, Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 005960C2
IsWindowUnicode.USER32(00000000), ref: 00596105
SendMessageW.USER32(00000000,-0000BBEE,00000000,00000000), ref: 00596120
SendMessageA.USER32 ref: 0059613F
GetWindowThreadProcessId.USER32(00000000), ref: 0059614E
GetWindowThreadProcessId.USER32(?,?), ref: 0059615F
SendMessageW.USER32(00000000,-0000BBEE,00000000,00000000), ref: 0059617F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: MessageSendWindow$ProcessThread$CaptureUnicode
String ID:
API String ID: 1994056952-0
Opcode ID: c10e80a72f9d52bee0ab2555683b472fe3131ac3e8c75ed7ac3a3d19b049d557
Instruction ID: 5f5bd9c4091a327d56c65b1fe878910f549193f4020e2e24993031529c009cf6
Opcode Fuzzy Hash: c10e80a72f9d52bee0ab2555683b472fe3131ac3e8c75ed7ac3a3d19b049d557
Instruction Fuzzy Hash: AE214171204609AFDA60EA5ACD81FA777DCFF18318B14842AF959C3243EB58FC54DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00404504, Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7dbb70c63f31cca4f9a8b326dc56b5315640ae4b8e3a9a2db1f81c0fb80e5d1
Instruction ID: 96354403c0afaaaaef82191ea09d5ee4f443f903325a7ca456b9162af8377ae8
Opcode Fuzzy Hash: a7dbb70c63f31cca4f9a8b326dc56b5315640ae4b8e3a9a2db1f81c0fb80e5d1
Instruction Fuzzy Hash: ABC125A2B102010BD714AEBDDC8476EB69A8BC5316F18827FF214EB3D6DA7CCD458348

Uniqueness

Uniqueness Score: -1.00%

Function 005EB8B8, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 216COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 005EB99E

Strings

.tmp, xrefs: 005EB95A
[rename], xrefs: 005EBA02, 005EBA3E
NUL, xrefs: 005EBA61
WININIT.INI, xrefs: 005EB94C
MoveFileEx, xrefs: 005EBBA8

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 4a3958e5bff3f11c0fd0539fab9c9feccb063bd630ce35d041a99da382b6eee7
Instruction ID: 7f4a6f7e4573ed635b396a7e01143dcc677d4100ffdb6c41e2386841c72ade6b
Opcode Fuzzy Hash: 4a3958e5bff3f11c0fd0539fab9c9feccb063bd630ce35d041a99da382b6eee7
Instruction Fuzzy Hash: 6D813C70A0024A9FEF04EBA6C982BDEBBB5FF49305F504065F480B7295DB75AE45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040735C, Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040781C: GetCurrentThreadId.KERNEL32 ref: 0040781F

GetTickCount.KERNEL32 ref: 00407393
GetTickCount.KERNEL32 ref: 004073AB
GetCurrentThreadId.KERNEL32 ref: 004073DA
GetTickCount.KERNEL32 ref: 00407405
GetTickCount.KERNEL32 ref: 0040743C
GetTickCount.KERNEL32 ref: 00407466
GetCurrentThreadId.KERNEL32 ref: 004074D6

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: c99536c8705a737af2acdd4a711a8f26efed1dc49d6131b915a76b8dc6e0d103
Instruction ID: 1834807f07eadc8e353512e6642721c09b58563245594fb87cb0de0cdd56de04
Opcode Fuzzy Hash: c99536c8705a737af2acdd4a711a8f26efed1dc49d6131b915a76b8dc6e0d103
Instruction Fuzzy Hash: 6C416E71A0C3419ED321AE78C98431FBED5AB80354F14893EE8D8973C1EA7CA8859757

Uniqueness

Uniqueness Score: -1.00%

Function 0045EF90, Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 107COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045F0E0,?,?,0043EB1C,00000001), ref: 0045F01E

Part of subcall function 00420E28: CreateFileW.KERNEL32(00000000,000000F0,000000F0,00000000,00000003,00000080,00000000,?,?,0043EB1C,0045F060,00000000,0045F0E0,?,?,0043EB1C), ref: 00420E77

Part of subcall function 0042127C: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,?,?,0043EB1C,0045F07B,00000000,0045F0E0,?,?,0043EB1C,00000001), ref: 0042129F

GetLastError.KERNEL32(00000000,0045F0E0,?,?,0043EB1C,00000001), ref: 0045F085

Part of subcall function 00425310: FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,0043EB1C,00000000,?,0045F094,00000000,0045F0E0), ref: 00425334
Part of subcall function 00425310: LocalFree.KERNEL32(00000001,0042538D,00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,0043EB1C,00000000,?,0045F094,00000000,0045F0E0), ref: 00425380

Strings

6A, xrefs: 0045F03D
Sac, xrefs: 0045F071, 0045F07B
HuC, xrefs: 0045F045
ac, xrefs: 0045F037
(6A, xrefs: 0045F0A4

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ErrorLast$CreateFileFormatFreeFullLocalMessageNamePath
String ID: 6A$(6A$HuC$Sac$ac
API String ID: 503893064-15412982
Opcode ID: 6a9fc178c5d0b79332a7eb5402c717825a51536e1ea42ec534b33d2ea8f82db4
Instruction ID: 07193d8dd532f789e5e103a749cea6d8697d4147bc1074b0383b1fef8d5c28ac
Opcode Fuzzy Hash: 6a9fc178c5d0b79332a7eb5402c717825a51536e1ea42ec534b33d2ea8f82db4
Instruction Fuzzy Hash: 4641D770E002198FDB10EFB5C8815EEB7E1AF48314F45857AE904A7383DB795A058BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0062FA6C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72fileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 0062FA98
GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0062FAB1
CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 0062FADB
CloseHandle.KERNEL32(00000000), ref: 0062FAF9

Strings

GetFinalPathNameByHandleW, xrefs: 0062FA8E
kernel32.dll, xrefs: 0062FA93

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandle$AttributesCloseCreateModule
String ID: GetFinalPathNameByHandleW$kernel32.dll
API String ID: 791737717-340263132
Opcode ID: dc3cbaaacebe00a38ae2bfa873ee621166375c85aa458246ce5d81e46ceb0b14
Instruction ID: 209979249f802be144ef12b73ecce6d297ad84e693ecff43869703900e4b4c5b
Opcode Fuzzy Hash: dc3cbaaacebe00a38ae2bfa873ee621166375c85aa458246ce5d81e46ceb0b14
Instruction Fuzzy Hash: E111E960740B2536F520736EBC87FBB205E8B417A9F140136B608DB3D3EAA99C414569

Uniqueness

Uniqueness Score: -1.00%

Function 004070F8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 0040710D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407113
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 0040712F

Strings

GetLogicalProcessorInformation, xrefs: 00407103
kernel32.dll, xrefs: 00407108
@, xrefs: 004071AD

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-79381301
Opcode ID: 853332416af2778c5bcc47278f3b3b8c9cbb13ce77f830fa8c852dff70c1a778
Instruction ID: b32848a7681182275f687d561da14b36461a078c67b786b57a386ce806aebad7
Opcode Fuzzy Hash: 853332416af2778c5bcc47278f3b3b8c9cbb13ce77f830fa8c852dff70c1a778
Instruction Fuzzy Hash: B1116371D08204BEEB10EFA5D845B5EBBF8DB40705F1481BBE814B77C1D67CAA40CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 00638030, Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0063804C
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,00640F89,00000000,006418A7), ref: 0063807B
GetWindowLongW.USER32(?,000000EC), ref: 00638090
SetWindowLongW.USER32 ref: 006380B7
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 006380D0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 006380F1

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 6dabd14f2d6b00543f17795517a371d9025c5b6deba07e2b6be9034b718c6715
Instruction ID: b0011e1ff4ae4fcfa0ec413d3ae5abc9a3a47f2e253fa650548b4e2c8616a965
Opcode Fuzzy Hash: 6dabd14f2d6b00543f17795517a371d9025c5b6deba07e2b6be9034b718c6715
Instruction Fuzzy Hash: 5D114CB5704710BFDB10EB68DD91FD233E9AB0E751F045190F614DB3A2CB24A984DB48

Uniqueness

Uniqueness Score: -1.00%

Function 00404850, Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00404872
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 00404878
GetStdHandle.KERNEL32(000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00404897
WriteFile.KERNEL32(00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 0040489D
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 004048B4
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,004039C0,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 004048BA

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 3c38a6900c6ae0a677f329c7a59347ab790708e3948bf16bbacba9ec7f3ff32e
Instruction ID: 7b55a0251aee8433f9b781807e181b785e45fa9a929db5067d5de1b812f83fde
Opcode Fuzzy Hash: 3c38a6900c6ae0a677f329c7a59347ab790708e3948bf16bbacba9ec7f3ff32e
Instruction Fuzzy Hash: 4101F9922492103EF210F7AA9D86F5B2ACCCB4476AF10863B7228F31C2C9385D449779

Uniqueness

Uniqueness Score: -1.00%

Function 00403F88, Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,000000FF,00404828,00000000,0040D8EF,00000000,0040DDFD,00000000,0040E0BF,00000000,0040E0F5), ref: 0040403F
Sleep.KERNEL32(0000000A,00000000,000000FF,00404828,00000000,0040D8EF,00000000,0040DDFD,00000000,0040E0BF,00000000,0040E0F5), ref: 00404055
Sleep.KERNEL32(00000000,00000000,?,000000FF,00404828,00000000,0040D8EF,00000000,0040DDFD,00000000,0040E0BF,00000000,0040E0F5), ref: 00404083
Sleep.KERNEL32(0000000A,00000000,00000000,?,000000FF,00404828,00000000,0040D8EF,00000000,0040DDFD,00000000,0040E0BF,00000000,0040E0F5), ref: 00404099

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 42b5e056f29d9ccb3932ac196e389176de7fdaf8f1a050f8a078efe818cff194
Instruction ID: 5a8b6537e3358d37646745b0bf3f1f0b51b6ff246b5f24ce9b798a5f4f8b74ba
Opcode Fuzzy Hash: 42b5e056f29d9ccb3932ac196e389176de7fdaf8f1a050f8a078efe818cff194
Instruction Fuzzy Hash: CEC145B26013018BD715CF69E884316BBE5ABC531AF0882FFE514AB3D5CB789991C798

Uniqueness

Uniqueness Score: -1.00%

Function 005F3530, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 239windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005F35AD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005F35D4
SetForegroundWindow.USER32(?,00000000,005F38AC,?,00000000,005F38EA), ref: 005F35E5
DefWindowProcW.USER32(00000000,?,?,?,00000000,005F38AC,?,00000000,005F38EA), ref: 005F3897

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 005F371F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: MessagePostWindow$ForegroundProc
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 602442252-3182603685
Opcode ID: 62dea3e7697ee2715068e0df7a4a9109a8fd0a59854e8d1006bc53015a8cefc9
Instruction ID: bce8259d755fc746d12e9127d346aabb9785a172cfecc655c3334fd5ba4cf73f
Opcode Fuzzy Hash: 62dea3e7697ee2715068e0df7a4a9109a8fd0a59854e8d1006bc53015a8cefc9
Instruction Fuzzy Hash: 3E91E234604208AFE715DF69DD51F69BBF6FB89700F1184A9FA049B7A1CB38AE40CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00596FD4, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103timethreadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00596F48: GetCursorPos.USER32 ref: 00596F4F

SetTimer.USER32(00000000,00000000,00000000,00000000), ref: 005970BF
GetCurrentThreadId.KERNEL32 ref: 005970F9
WaitMessage.USER32(00000000,0059713D,?,?,?,00000000), ref: 0059711D

Strings

DdY, xrefs: 00596FF6, 00597000, 00597051, 00597079, 005970B1, 005970D2, 00597085, 00597061, 00597064, 0059700C, 00597015
D@e, xrefs: 005970FE

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CurrentCursorMessageThreadTimerWait
String ID: D@e$DdY
API String ID: 3909455694-944187075
Opcode ID: 582c6504b806dd8def35d89b041f389fa1f92155a0287ec2098a34ecb6afa868
Instruction ID: affdd4d1fc9358369649ba66229e32985035048600835e3122386b778b2aa322
Opcode Fuzzy Hash: 582c6504b806dd8def35d89b041f389fa1f92155a0287ec2098a34ecb6afa868
Instruction Fuzzy Hash: 97418B30A28308EFDF11DBA4C98ABADBBF6FB09304F1144AAE40497291D774AE44DF11

Uniqueness

Uniqueness Score: -1.00%

Function 00642038, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00595F5C: SetWindowTextW.USER32(?,00000000), ref: 00595F8D

ShowWindow.USER32(?,00000005,00000000,006422EC,?,?,00000000), ref: 0064207E

Part of subcall function 005A3B4C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005A3B5F

Part of subcall function 004216CC: SetCurrentDirectoryW.KERNEL32(00000000,?,006420A6,00000000,006422B3,?,?,00000005,00000000,006422EC,?,?,00000000), ref: 004216D7

Part of subcall function 005A36A0: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005A3735,?,?,?,00000001,?,005EE002,00000000,005EE06D), ref: 005A36D5

Strings

IMsg, xrefs: 00642152
.dat, xrefs: 006420C5
Uninstall, xrefs: 00642064
.msg, xrefs: 006420E4

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: d312e3c85ea88b55687881db8613f61c0899f7ff77010ceb5e1377c2188460ee
Instruction ID: 2f7f9b1931b20fc7fdcf27a7e003db6513de1f0c52ce319b7ba31160c5c47d5f
Opcode Fuzzy Hash: d312e3c85ea88b55687881db8613f61c0899f7ff77010ceb5e1377c2188460ee
Instruction Fuzzy Hash: 27418374A00606AFCB01EF68DD6699FBBB6FB89700F609465F500A7761DB34AE01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0060C37C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32 ref: 0060C3AE
GetExitCodeProcess.KERNEL32 ref: 0060C3D1
CloseHandle.KERNEL32(?,0060C404,00000001,00000000,000000FF,000004FF,00000000,0060C3FD), ref: 0060C3F7

Strings

GetExitCodeProcess, xrefs: 0060C3DA
MsgWaitForMultipleObjects, xrefs: 0060C3BD

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 8d84380d21dca03a84d6e341844a8430715693fe03e730dd792f4d45229b666f
Instruction ID: 14e2a31ffdb85c1c148fb64c1c9ccbc96deb50cbe69c01d5250a41a6b6c41cd3
Opcode Fuzzy Hash: 8d84380d21dca03a84d6e341844a8430715693fe03e730dd792f4d45229b666f
Instruction Fuzzy Hash: 0801DF70680200AFDF18EBA88992EAE37E9EB89730F104671FA10D73D1DA30AD40C655

Uniqueness

Uniqueness Score: -1.00%

Function 00405634, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 0040566B
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 00405671
GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 00405680
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 00405691

Strings

:, xrefs: 00405650

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 07451cd3840e142b4bbe21be877f75ec33b3997126205fcf31e678c3acf2bcb7
Instruction ID: 235d6df361bd0d32668981a988864fb0fb722a42ac84d823f2286f0eede1056f
Opcode Fuzzy Hash: 07451cd3840e142b4bbe21be877f75ec33b3997126205fcf31e678c3acf2bcb7
Instruction Fuzzy Hash: 0FF0F061140B447AD320EB65C852AEB72DCDF44305F40883F7AC8D73D2E67E8948976A

Uniqueness

Uniqueness Score: -1.00%

Function 00579B0C, Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc169780782e56d7d00c5f6711246fd6b559e13815ceaf143d1922ddb669337
Instruction ID: a11511dbe52bbd7c49f88581702cb08e114547a3c93dec4041a8d86bc4f002f2
Opcode Fuzzy Hash: ccc169780782e56d7d00c5f6711246fd6b559e13815ceaf143d1922ddb669337
Instruction Fuzzy Hash: 5511A56170C2598ADB34AE7A7D05B9A2FD8FF81748F148419BC0CDB256CA68CC45A2B0

Uniqueness

Uniqueness Score: -1.00%

Function 00594028, Relevance: 7.5, APIs: 5, Instructions: 39threadCOMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32(00000000), ref: 0059403A
SetEvent.KERNEL32(00000000), ref: 00594066
GetCurrentThreadId.KERNEL32 ref: 0059406B
MsgWaitForMultipleObjects.USER32 ref: 00594094
CloseHandle.KERNEL32(00000000,00000000), ref: 005940A1

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseCurrentEventHandleHookMultipleObjectsThreadUnhookWaitWindows
String ID:
API String ID: 2132507429-0
Opcode ID: 4a33cb34fb55e24b465aab2880c9c23fddd536ab397f58cf9b7d1dc421f038a5
Instruction ID: 66ee4399d35240a83b59ece6f4096d6fe0d5991273ad28ab74790b3d8ca4258d
Opcode Fuzzy Hash: 4a33cb34fb55e24b465aab2880c9c23fddd536ab397f58cf9b7d1dc421f038a5
Instruction Fuzzy Hash: D8014F702047019FDB21EBB4DD4AB5A3BE5BB44315F104B29B394CB191EB789881CB57

Uniqueness

Uniqueness Score: -1.00%

Function 005EB3C0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005EB4FB), ref: 005EB4AB
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,005EB4FB), ref: 005EB4BB

Strings

_iu, xrefs: 005EB44D
.tmp, xrefs: 005EB45F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: b207370a88c69b87b64991c9a9094a867ebaf347adcaa8c2df09374dd624d718
Instruction ID: 4916953790dd09546032e58934b6d798705771e5c4406dd0652061969f9ce21d
Opcode Fuzzy Hash: b207370a88c69b87b64991c9a9094a867ebaf347adcaa8c2df09374dd624d718
Instruction Fuzzy Hash: 6031A230E00259AFEF15EBA6D942BDEBBB5BF45704F108069F580B72D2D7746E018B94

Uniqueness

Uniqueness Score: -1.00%

Function 00642604, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,000000EC,00000000,00642702,?,?,0065A16C,?,00642B32,00000000,00642B3C,?,00000000,00642B6C,?,?), ref: 00642674
SetFileAttributesW.KERNEL32(00000000,00000000,00000000,000000EC,00000000,00642702,?,?,0065A16C,?,00642B32,00000000,00642B3C,?,00000000,00642B6C), ref: 0064269D
MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,000000EC,00000000,00642702,?,?,0065A16C,?,00642B32,00000000,00642B3C,?,00000000), ref: 006426B6

Strings

isRS-%.3u.tmp, xrefs: 00642653

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: cfa955785dce08308da2a9560d282999264c7144dd9ba908ae92c21cfdc23105
Instruction ID: 26d872f2ca90b765898ef8e946f0cb0f3b399628d42aedf7d99cfaa02db8b1c0
Opcode Fuzzy Hash: cfa955785dce08308da2a9560d282999264c7144dd9ba908ae92c21cfdc23105
Instruction Fuzzy Hash: 9631B471E102099BDB00EFA9C991ADEB7B9AF44314F61017EF814F32D1DB785E40CA98

Uniqueness

Uniqueness Score: -1.00%

Function 005F3018, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000B06,00000000,00000000), ref: 005F3032
SendMessageW.USER32(00000000,00000B00,00000000,00000000), ref: 005F30CF

Strings

Failed to create DebugClientWnd, xrefs: 005F3098
Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 005F305E

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 20d8301daefdcc1c930f92497dffa2579fa17c75702bdadb0966968b885a6229
Instruction ID: dd53f4ef3e6abbda90f0f8c57914ca1fbdbdba4d6128e838a348c3b15e66de6c
Opcode Fuzzy Hash: 20d8301daefdcc1c930f92497dffa2579fa17c75702bdadb0966968b885a6229
Instruction Fuzzy Hash: 6F11C4B06053506FF301EB69DC85B6A7F98AB49318F100029F6808B391D7795984C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0060BEE4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A2A98: GetFullPathNameW.KERNEL32(00000000,00001000,?,?,00000002,?,?,0065A16C,00000000,005EB8FF,00000000,005EBBDA,?,?,0065A16C), ref: 005A2AC9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0060BF27
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 0060BF43

Strings

LoadTypeLib, xrefs: 0060BF32
RegisterTypeLib, xrefs: 0060BF4E

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Type$FullLoadNamePathRegister
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 4170313675-2435364021
Opcode ID: aaf0d9d733847b39a2833b4a670fea7d6a6fa6472db18ab2e7c91547b7ab254c
Instruction ID: 3e3fd5eda55fc89f2729cabf13b48581482c001c5d8b98291c3a2ec055bbf16c
Opcode Fuzzy Hash: aaf0d9d733847b39a2833b4a670fea7d6a6fa6472db18ab2e7c91547b7ab254c
Instruction Fuzzy Hash: 6E0165706402096BD714FAB6CC43B5EB7AEDB45744F519476B500E72C2DB74AE058A18

Uniqueness

Uniqueness Score: -1.00%

Function 005EBAF1, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000020), ref: 005EBAFC

Part of subcall function 004210CC: DeleteFileW.KERNEL32(00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 004210DC
Part of subcall function 004210CC: GetLastError.KERNEL32(00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 004210EB
Part of subcall function 004210CC: GetFileAttributesW.KERNEL32(00000000,00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000,00000000), ref: 004210F3
Part of subcall function 004210CC: RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,0065A16C,?,00642B17,00000000,00642B6C,?,?,00000005,?,00000000,00000000), ref: 0042110E

MoveFileW.KERNEL32(00000000,00000000), ref: 005EBB29

Part of subcall function 005EAE9C: GetLastError.KERNEL32(00000000,005EBBB2,00000005,00000000,005EBBDA,?,?,0065A16C,?,00000000,00000000,00000000,?,006427AF,00000000,006427CA), ref: 005EAE9F

Strings

MoveFile, xrefs: 005EBB32
DeleteFile, xrefs: 005EBB0D

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: File$AttributesErrorLast$DeleteDirectoryMoveRemove
String ID: DeleteFile$MoveFile
API String ID: 3947864702-139070271
Opcode ID: a4aba6e0d55b0d8c93a72f52b8f7c853958d9bbe197efb9613161f333e57f5fd
Instruction ID: dedb0731f5aca1909e004e570d1e8ca08e76d9df5ad34bdc3e53512e679024dd
Opcode Fuzzy Hash: a4aba6e0d55b0d8c93a72f52b8f7c853958d9bbe197efb9613161f333e57f5fd
Instruction Fuzzy Hash: E9F04971618245CFFB09FBB7D94265F77E8FB80304F60447AB444E3696DA3CAC014619

Uniqueness

Uniqueness Score: -1.00%

Function 0060E824, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A4104: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005A47DE,?,00000000,?,005A477E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005A47DE), ref: 005A4120

RegCloseKey.ADVAPI32(00000000,?,00000001,00000000,00000003,0060E678,00000003,00000000,0060E9C7,00000000,0060EB81,?,0060E678,?,00000000,00000000), ref: 0060E871

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 0060E846
.NET Framework not found, xrefs: 0060E880
InstallRoot, xrefs: 0060E860

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 0db7a2505268452168f88460fa7d4f093a22f2acdf33bdc38415f76fc569b7c9
Instruction ID: 937cdb7b09f7b19c4fd13f6d8fa40e9f0d224251f8a686aacf26c8413afe7978
Opcode Fuzzy Hash: 0db7a2505268452168f88460fa7d4f093a22f2acdf33bdc38415f76fc569b7c9
Instruction Fuzzy Hash: F4F022707401245BD71CEB999C45B5B6BEAEFC1312F50963AFA84C72E1D672CC01CA12

Uniqueness

Uniqueness Score: -1.00%

Function 005A412C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(?,00000000), ref: 005A4138
GetModuleHandleW.KERNEL32(advapi32.dll,RegDeleteKeyExW,?,00000000,005A431F,00000000,005A4337,?,?,?), ref: 005A4153

Strings

RegDeleteKeyExW, xrefs: 005A4149
advapi32.dll, xrefs: 005A414E

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: DeleteHandleModule
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 3550747403-4033151799
Opcode ID: 160e4b6544adcf4fdff70b7ddad2362e1d6ffef6edba04b7c940305ecc1f4e5d
Instruction ID: 24a19007187fa3e954bfb7c5f533a78f533840c9612a225fbfc0a1645700a09b
Opcode Fuzzy Hash: 160e4b6544adcf4fdff70b7ddad2362e1d6ffef6edba04b7c940305ecc1f4e5d
Instruction Fuzzy Hash: D9E065706403107AE324A7F5AC49B9B3F1EF7A6356F101626B201951A183E848C4CA94

Uniqueness

Uniqueness Score: -1.00%

Function 005A4DD0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,?,00000004,006529D4,005F30B6,005F3530,005F2FD4,?,00000B06,00000000,00000000), ref: 005A4DEA

Part of subcall function 00412174: GetProcAddress.KERNEL32(?,?), ref: 0041219E

Part of subcall function 005A4D34: GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005A4E2A,?,00000004,006529D4,005F30B6,005F3530,005F2FD4,?,00000B06,00000000,00000000), ref: 005A4D4B

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,?,00000004,006529D4,005F30B6,005F3530,005F2FD4,?,00000B06,00000000,00000000), ref: 005A4E1B

Strings

ChangeWindowMessageFilterEx, xrefs: 005A4DE0
user32.dll, xrefs: 005A4DE5

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: HandleModule$AddressChangeFilterMessageProcWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 989041661-2676053874
Opcode ID: a468ff53dc36a167302635eed63fa72a5b8bfc61478f502a5103e181a43afb32
Instruction ID: b564a6e73f9ff7a8b8b0df1a95b73bedaad1537207e190879b2e2c60f79f6686
Opcode Fuzzy Hash: a468ff53dc36a167302635eed63fa72a5b8bfc61478f502a5103e181a43afb32
Instruction Fuzzy Hash: 71F0A070244710AFE725EBF8EC49B5A3BAAFBC6306F001729F10096290C3F81884CE97

Uniqueness

Uniqueness Score: -1.00%

Function 004D0750, Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,004D09BF,?,?), ref: 004D0798
LeaveCriticalSection.KERNEL32(005AC124,004D0996,?,00000000,004D09BF,?,?), ref: 004D0989

Strings

$O`, xrefs: 004D0862, 004D086F, 004D0881, 004D0896
Default, xrefs: 004D0846

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: $O`$Default
API String ID: 3168844106-2728598177
Opcode ID: b0de8cb36483c9711dcf09538528f7f5a70b48d8dbad3206fe63fb61e301f474
Instruction ID: ea35a01b074c7fef8f496ad166c102e94058d147a50752607aa3668a906d1aeb
Opcode Fuzzy Hash: b0de8cb36483c9711dcf09538528f7f5a70b48d8dbad3206fe63fb61e301f474
Instruction Fuzzy Hash: F6516C74A04348DFDB01DFA5C961BAEBBF5EF89304F6544ABE804A7392D7389944CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3D0, Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040C3E1
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040C43F
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040C49C
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040C4CF

Part of subcall function 0040C38C: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040C44D), ref: 0040C3A3
Part of subcall function 0040C38C: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040C44D), ref: 0040C3C0

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 4eac2356409ef147f6dd06d04f3d794953fa8967caf4c10e931bea6e4cba19e9
Instruction ID: e9f5d2c0856ccfa5dcf6400bd65efe5596845db7ae9ae7d0ee03afc8cd4be72f
Opcode Fuzzy Hash: 4eac2356409ef147f6dd06d04f3d794953fa8967caf4c10e931bea6e4cba19e9
Instruction Fuzzy Hash: FF315A70A1021ADBCB50DFA9C8C4AAEB3B9FF04315F40827AE851F7291DB789A04CB54

Uniqueness

Uniqueness Score: -1.00%

Function 005AC1A8, Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 005AC1C1
MulDiv.KERNEL32(?,005AC2F3,?), ref: 005AC1D4
MulDiv.KERNEL32(?,?,?), ref: 005AC1EB
MulDiv.KERNEL32(?,005AC2F3,?), ref: 005AC209

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b200911543061bb55d9bcc65ecf45c0663e37d27368ed6f25b3f1809b6db924
Instruction ID: f4080f3cbef4ab9687ae981563ecd022299ff8e5117fe38d545c343aca7e9ea8
Opcode Fuzzy Hash: 9b200911543061bb55d9bcc65ecf45c0663e37d27368ed6f25b3f1809b6db924
Instruction Fuzzy Hash: EF112A76A04248AFCB44DEEDC8C4E9E7BEDAF09364B144496FD18DB242C674ED40C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0059729C, Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 005972AF
GetWindowLongW.USER32(?,000000EC), ref: 005972F1
SetWindowLongW.USER32 ref: 0059730B
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,C31852FF,?,00000000,?,005973C5,?,?,?,00000000), ref: 00597333

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window$Long$Visible
String ID:
API String ID: 2967648141-0
Opcode ID: d69bbce2f9881862767e88053f17f6db05904e6eee5b6bd92c90e8df37d6ec8c
Instruction ID: 3968c7cc5de43a5d2ca233551b98b94eda74dcdf96efc22b4dd3bcf3653c603e
Opcode Fuzzy Hash: d69bbce2f9881862767e88053f17f6db05904e6eee5b6bd92c90e8df37d6ec8c
Instruction Fuzzy Hash: 50118E30208244AFCB10DB28D888FAA7FE9EB0D311F549992F884CB362C634EEC0D750

Uniqueness

Uniqueness Score: -1.00%

Function 0045F8AC, Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,0043F820,?,00000001,00000000,?,0045F7EE,00000000,00000000,?,0065A16C,?,?,00636218), ref: 0045F8C3
LoadResource.KERNEL32(?,0045F948,?,?,?,0043F820,?,00000001,00000000,?,0045F7EE,00000000,00000000,?,0065A16C,?), ref: 0045F8DD
SizeofResource.KERNEL32(?,0045F948,?,0045F948,?,?,?,0043F820,?,00000001,00000000,?,0045F7EE,00000000,00000000), ref: 0045F8F7
LockResource.KERNEL32(0045F194,00000000,?,0045F948,?,0045F948,?,?,?,0043F820,?,00000001,00000000,?,0045F7EE,00000000), ref: 0045F901

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 0d772e799b43ded5d388934828789886becdccb3a148720acbb231569ba4bc61
Instruction ID: fa0fe6dd828bfbb9f04905aa0b52ab9c5d73502f4efb7332ac635971d8a6ef69
Opcode Fuzzy Hash: 0d772e799b43ded5d388934828789886becdccb3a148720acbb231569ba4bc61
Instruction Fuzzy Hash: CBF06D726012046F4748FE6EA981D5B77DCEE88364320002FFE18C7202DB78DD158779

Uniqueness

Uniqueness Score: -1.00%

Function 005EDCD4, Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005A4104: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,005A47DE,?,00000000,?,005A477E,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005A47DE), ref: 005A4120

RegDeleteValueW.ADVAPI32(?,00000000,?,00000002,00000000,?,?,?,00611B33), ref: 005EDD10
RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000002,00000000,?,?,?,00611B33), ref: 005EDD19
RemoveFontResourceW.GDI32(00000000), ref: 005EDD26
SendNotifyMessageW.USER32(0000FFFF,0000001D,00000000,00000000), ref: 005EDD3A

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 301b2f2a6169e72b72f255db102ad7ebbddb6b0f23f8f113e07d21914d9d15b1
Instruction ID: a83e66db14ee3ef44903a8c6b8c1072e1cfb4bb01409331395507dad8069434f
Opcode Fuzzy Hash: 301b2f2a6169e72b72f255db102ad7ebbddb6b0f23f8f113e07d21914d9d15b1
Instruction Fuzzy Hash: 14F0B4B270030166EA20F6B69D47F5F228C5F84744F14482AB600DB1D3D678DC418228

Uniqueness

Uniqueness Score: -1.00%

Function 004EC734, Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004EC741
GetCurrentProcessId.KERNEL32(?,00000000,00000000,005980A6,?,?,00000000,00000001,005963A3,?,00000000,00000000,00000000,00000000), ref: 004EC74A
GlobalFindAtomW.KERNEL32(00000000), ref: 004EC75F
GetPropW.USER32(00000000,00000000), ref: 004EC776

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: 2c2a0732317d355b121923d2876d307d8dab455008391c21f93d8549ac122c27
Instruction ID: 4f03a5962e9ee281ac692fc879289425f8bafe068471be1685bddecbe315992d
Opcode Fuzzy Hash: 2c2a0732317d355b121923d2876d307d8dab455008391c21f93d8549ac122c27
Instruction Fuzzy Hash: 17F0A7B2210362668630B7F75DC18BB22CD8F047AB300053BFA00D3242C67C8C4297BD

Uniqueness

Uniqueness Score: -1.00%

Function 0062F8F0, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008), ref: 0062F8F9
OpenProcessToken.ADVAPI32(00000000,00000008), ref: 0062F8FF
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008), ref: 0062F921
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008), ref: 0062F932

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: b39466c9b63b973964fe0a1342c5e1dcfa881651e3a7fd1ebbbb8650fd33f34f
Instruction ID: 95db9f764c5e1960dd6f28da8fcbc1181ac7628f2c63f52efa86512f617db7b2
Opcode Fuzzy Hash: b39466c9b63b973964fe0a1342c5e1dcfa881651e3a7fd1ebbbb8650fd33f34f
Instruction Fuzzy Hash: 7AF039B56443007BD600EBA58C82FDB72ECAB48314F00493ABF98C7291DB79D8599766

Uniqueness

Uniqueness Score: -1.00%

Function 004D7A44, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004D7A4D
SelectObject.GDI32(00000000,058A00B4), ref: 004D7A5F
GetTextMetricsW.GDI32(00000000,?,00000000,058A00B4,00000000), ref: 004D7A6A
ReleaseDC.USER32 ref: 004D7A7B

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: c3b52f8e2698c81a15e7f456db96d5918527498da2c22cbe8b17170079f42710
Instruction ID: cbc5d594e46955a59ad0a4a7ca13f04955124c1881b4fbe9347f16bee895defd
Opcode Fuzzy Hash: c3b52f8e2698c81a15e7f456db96d5918527498da2c22cbe8b17170079f42710
Instruction Fuzzy Hash: D4E0486164667122D511A2660D52BEF25488F023A6F081117FD44DA3D1E64DCA5083FA

Uniqueness

Uniqueness Score: -1.00%

Function 005ECFCC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 005ED068
GetLastError.KERNEL32(00000000,005ED0B0,?,?,?,00000001), ref: 005ED077

Part of subcall function 005A3B4C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005A3B5F

Strings

<, xrefs: 005ED022

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 421f48ec5dbe7c48d11cfda0999c41f116d012a6745bb79e33a7f4cbb9a7d96e
Instruction ID: a29c265eefe6ad4771beee4b9b9f887feccdb47a8447e8857d9483cc50b5698c
Opcode Fuzzy Hash: 421f48ec5dbe7c48d11cfda0999c41f116d012a6745bb79e33a7f4cbb9a7d96e
Instruction Fuzzy Hash: 76215C70A00249DFDB14EFA6C88669E7BF9BF48744F14043AF844E3281E7749D41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0064098E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 006409CE

Strings

@, xrefs: 00640994
/INITPROCWND=$%x , xrefs: 006409FE

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: fd323495d9a1def65a311339e5eaf3d567e799b2ba22f802871307d8b5a9922b
Instruction ID: 16a5f4afe6c6fa2e56ac49bb5369910dc0eef07ef878cb0bd6c829c251f5b2ee
Opcode Fuzzy Hash: fd323495d9a1def65a311339e5eaf3d567e799b2ba22f802871307d8b5a9922b
Instruction Fuzzy Hash: 5321E730A043199FEB01DBA4D851BEE77F6EB49310F504479FA00D7392DB749944CB84

Uniqueness

Uniqueness Score: -1.00%

Function 006400BC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00640129
CloseHandle.KERNEL32(006401D4,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00640190,?,00640180,00000000), ref: 00640146

Part of subcall function 00640014: GetLastError.KERNEL32(00000000,006400AF,?,?,?), ref: 00640037

Strings

D, xrefs: 00640103

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: dc2ae9c730d977263de040bcaade46fc29444b2489cea2f595ee73c71db0f54f
Instruction ID: 0e956af7d171e19ceff54b48a651bf16522d52c2b4e92dc377d64474bdf90f28
Opcode Fuzzy Hash: dc2ae9c730d977263de040bcaade46fc29444b2489cea2f595ee73c71db0f54f
Instruction Fuzzy Hash: 691161B1604608AFEB00DBE5CC82FDE77ADEF08704F51007AF604E7291D6749E00CA68

Uniqueness

Uniqueness Score: -1.00%

Function 006417EF, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 005ED36C: GetCurrentProcess.KERNEL32(00000028), ref: 005ED37C
Part of subcall function 005ED36C: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 005ED382

SetForegroundWindow.USER32(?), ref: 00641828

Strings

Restarting Windows., xrefs: 006417FF
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 0064185F

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 7727875be35e82995dd444ca35356ba5d29f24a80d31f7de720067c18b3945ba
Instruction ID: 1e922679101b66e59528309f19ec5da7f9d56ddd2907a6e33e54734044c9099e
Opcode Fuzzy Hash: 7727875be35e82995dd444ca35356ba5d29f24a80d31f7de720067c18b3945ba
Instruction Fuzzy Hash: BD118274A10344DFE705EB65E945BD837E6EB49744F10007AF404EB3E2CA78AD81C718

Uniqueness

Uniqueness Score: -1.00%

Function 0064234C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00636878: FreeLibrary.KERNEL32(?,00642378,00000000,00642387,?,?,?,?,?,00642E6B), ref: 0063688E

Part of subcall function 00636494: GetTickCount.KERNEL32 ref: 006364DC

Part of subcall function 005F31CC: SendMessageW.USER32(00000000,00000B01,00000000,00000000), ref: 005F31EB

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,00642E6B), ref: 006423A1
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,00642E6B), ref: 006423A7

Strings

Detected restart. Removing temporary directory., xrefs: 0064235B

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: a837815f30a3e7c6f7ab639caf095285535ccb8080c05a28af89a2829eaa4652
Instruction ID: f356c9cb3b5d26a10aa2bfc8fa014af753853a87c7a0b199b033368e70703c39
Opcode Fuzzy Hash: a837815f30a3e7c6f7ab639caf095285535ccb8080c05a28af89a2829eaa4652
Instruction Fuzzy Hash: 4DE02B712047457DE3237BB6EC2686A3FAFFB867A4B610879F100C2502C92D9820C178

Uniqueness

Uniqueness Score: -1.00%

Function 005A4E80, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 005A4F10: GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005A4E8E,?,?,?,00641499,0000000A,00000002,00000001,00000031,00000000,006416C7), ref: 005A4F1E

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonCreate,?,?,?,00641499,0000000A,00000002,00000001,00000031,00000000,006416C7,?,00000000,00641794), ref: 005A4E98

Part of subcall function 00412174: GetProcAddress.KERNEL32(?,?), ref: 0041219E

Strings

ShutdownBlockReasonCreate, xrefs: 005A4E8E
user32.dll, xrefs: 005A4E93

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 1883125708-2866557904
Opcode ID: da55bcfe139e071712d581091486dfd1bd5b1648377e905e63a465497453c95d
Instruction ID: ec7b416f7652cbfbe4990c7aea9d13080f9ad9aa2dd4de1d6f47650ac232d0a9
Opcode Fuzzy Hash: da55bcfe139e071712d581091486dfd1bd5b1648377e905e63a465497453c95d
Instruction Fuzzy Hash: AAE0C2633501613A560171FE0C8186F08CCFDC3659310083AF210D2242DAE8CD0604AE

Uniqueness

Uniqueness Score: -1.00%

Function 005A3B78, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemWow64DirectoryW,?,005EB680,00000000,005EB752,?,?,0065A16C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005A3B92

Part of subcall function 00412174: GetProcAddress.KERNEL32(?,?), ref: 0041219E

Strings

GetSystemWow64DirectoryW, xrefs: 005A3B88
kernel32.dll, xrefs: 005A3B8D

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 1646373207-1816364905
Opcode ID: a30e71d80a09bc17dcd4f10f3704a9b7e9756e6d83aa594f8642d2a39c4ebf24
Instruction ID: a53c00a7aaf254811336937ee4fcbddcbf8d881f681fc338ff23a9efc9efc3ac
Opcode Fuzzy Hash: a30e71d80a09bc17dcd4f10f3704a9b7e9756e6d83aa594f8642d2a39c4ebf24
Instruction Fuzzy Hash: A9E0266074074123D72071BA4D83F5F158A6BCA718F14093E3A40D62D3EDFCCA4405B6

Uniqueness

Uniqueness Score: -1.00%

Function 005A4D34, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005A4E2A,?,00000004,006529D4,005F30B6,005F3530,005F2FD4,?,00000B06,00000000,00000000), ref: 005A4D4B

Part of subcall function 00412174: GetProcAddress.KERNEL32(?,?), ref: 0041219E

Strings

user32.dll, xrefs: 005A4D46
ChangeWindowMessageFilter, xrefs: 005A4D41

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 1646373207-2498399450
Opcode ID: c9b26ee343c20cc6d5ecd581e8732b26248926ee0a7d7efaee528e7c0cb9aad9
Instruction ID: b9be6d4b475f79c121acc82d51ed6bdfe3a936d00708f512d8426a92397d99dd
Opcode Fuzzy Hash: c9b26ee343c20cc6d5ecd581e8732b26248926ee0a7d7efaee528e7c0cb9aad9
Instruction Fuzzy Hash: 78E01270240700AFE721EBE49D45B9A3FA6EBC630AF101619B24496190C7F804C9CA92

Uniqueness

Uniqueness Score: -1.00%

Function 005A4F10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005A4E8E,?,?,?,00641499,0000000A,00000002,00000001,00000031,00000000,006416C7), ref: 005A4F1E

Part of subcall function 00412174: GetProcAddress.KERNEL32(?,?), ref: 0041219E

Strings

user32.dll, xrefs: 005A4F19
ShutdownBlockReasonDestroy, xrefs: 005A4F14

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 1a4bd3fb78c0a3d1b20c4f76baddccb3c874ab258f27c73a0179db981a2f585c
Instruction ID: 672006cb48ee980ec3503e0054daf2b031ccac02c4a6bb70ddbaf3d03a5296fc
Opcode Fuzzy Hash: 1a4bd3fb78c0a3d1b20c4f76baddccb3c874ab258f27c73a0179db981a2f585c
Instruction Fuzzy Hash: BDD0C7A27557522E2920A5F91CD19DF068C99D32953041176F710D2341DAD5DC521564

Uniqueness

Uniqueness Score: -1.00%

Function 00642EA0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0064D4FE,00000001,00000000,0064D524,?,?,000000EC,00000000), ref: 00642EAA

Part of subcall function 00412174: GetProcAddress.KERNEL32(?,?), ref: 0041219E

Strings

user32.dll, xrefs: 00642EA5
DisableProcessWindowsGhosting, xrefs: 00642EA0

Memory Dump Source

Source File: 00000005.00000002.715504222.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.715498380.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715895493.000000000064E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715912081.0000000000659000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715922057.000000000065C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715931697.000000000065E000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.715939488.0000000000660000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.715951208.0000000000661000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.715957202.0000000000663000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Driver_Updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 07418e8369ef4c83ac46ccbbdd22f774364283728e43da7fbaf5f2d1119c3183
Instruction ID: 3ebf0ee889b8b13f2fbf5f6bef7060621464173630ebe2f5f9735cafe6cb5985
Opcode Fuzzy Hash: 07418e8369ef4c83ac46ccbbdd22f774364283728e43da7fbaf5f2d1119c3183
Instruction Fuzzy Hash: 0CB092A0780313305A14F2B20E2298B180A4C807087A204593A20D0182DEA885911069

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PCHelpSoftDriverUpdater.exe PID: 6488 Parent PID: 6364 PCHelpSoftDriverUpdater.exeCOMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	1300
Total number of Limit Nodes:	33

Executed Functions

Function 0097D114, Relevance: 9.1, APIs: 6, Instructions: 111
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,00000000,0097D23C), ref: 0097D170
NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,?), ref: 0097D192
ReadProcessMemory.KERNEL32(00000000,?,?,000001D8,?,00000410,00000000,00000000,00000000,0097D23C), ref: 0097D1B7
ReadProcessMemory.KERNEL32(00000000,?,?,00000290,?,00000000,?,?,000001D8,?,00000410,00000000,00000000,00000000,0097D23C), ref: 0097D1DB
ReadProcessMemory.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,00000290,?,00000000,?,?,000001D8,?,00000410), ref: 0097D215
CloseHandle.KERNEL32(00000000,00000410,00000000,00000000,00000000,0097D23C), ref: 0097D22D

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Process$MemoryRead$CloseHandleInformationOpenQuery
String ID:
API String ID: 452587172-0
Opcode ID: 4933085f5b29e06f3cd7654a9d37f810539946879d7e6071838efcf440e4fcfd
Instruction ID: a242eed67a7fc56fbcd161cbf9b460dea7e9f6109ad705df05e685290ec95dc0
Opcode Fuzzy Hash: 4933085f5b29e06f3cd7654a9d37f810539946879d7e6071838efcf440e4fcfd
Instruction Fuzzy Hash: D9413FB1A00219AEDB50DBA5DC41FEEB7FCEF08704F5044AAB618E2181E674AE41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D970, Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040DA30,?,?), ref: 0040D9A2
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040DA30,?,?), ref: 0040D9AB

Part of subcall function 0040D838: FindFirstFileW.KERNEL32(00000000,?,00000000,0040D896,?,00000001), ref: 0040D86B
Part of subcall function 0040D838: FindClose.KERNEL32(00000000,00000000,?,00000000,0040D896,?,00000001), ref: 0040D87B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: c8d1c3d31f145161683b1384c919161d0d382acec60dc4765eb6064bd050550c
Instruction ID: b909e58ebf14aea200b229b4774ecc7dbae93d6565019016332076b7a8ce4a7d
Opcode Fuzzy Hash: c8d1c3d31f145161683b1384c919161d0d382acec60dc4765eb6064bd050550c
Instruction Fuzzy Hash: 60116070A042099BDB04EB95C882AAEB3B9EF44304F50407EF914B33D2D7385E098A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D838, Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040D896,?,00000001), ref: 0040D86B
FindClose.KERNEL32(00000000,00000000,?,00000000,0040D896,?,00000001), ref: 0040D87B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 503b068a5e25caa2ef2d9a8afba26745935dc7f8a4317aa1ffb9d167a2b934a3
Instruction ID: 9f0b7f41a0254bfe0e0b0bd36dab9945d52636fdc0296f32eb456b68b1d7e2f6
Opcode Fuzzy Hash: 503b068a5e25caa2ef2d9a8afba26745935dc7f8a4317aa1ffb9d167a2b934a3
Instruction Fuzzy Hash: 64F0E272900604AFD710FBB5DD0298EB3ACEB44310BA105B7F814F26D1E7389F14A55C

Uniqueness

Uniqueness Score: -1.00%

Function 005D3F64, Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON

Download Yara Rule

APIs

Part of subcall function 005D3BA0: GetModuleHandleW.KERNEL32(kernel32.dll,00000002,005D3F6F,00000000,?,0097D4ED,00000000,0097D6BD,?,00000000,0097D712,?,?,00000000), ref: 005D3BB4

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005D3F75

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CreateHandleModuleSnapshotToolhelp32
String ID:
API String ID: 3074443813-0
Opcode ID: f2fb68aa519022d1edbfe97aec593dce6a1cdd51f7a60040e7715d4f2d7d8b70
Instruction ID: e60690f94ca2c02146b95aff72a06363e9059bceb62d6fa6e379e6af5be70767
Opcode Fuzzy Hash: f2fb68aa519022d1edbfe97aec593dce6a1cdd51f7a60040e7715d4f2d7d8b70
Instruction Fuzzy Hash: 1EC080A251A535134B3063FD2D884C25F4DDC451B37140B53B524D33D297558C4151D0

Uniqueness

Uniqueness Score: -1.00%

Function 009AA254, Relevance: 63.4, APIs: 17, Strings: 19, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/REPAIR, xrefs: 009AA8CA
/OPTIONS, xrefs: 009AA462
PCHelpSoftDriverUpdater, xrefs: 009AA828, 009AA94C, 009AA961
PC HelpSoft Driver Updater, xrefs: 009AA60D
/STARTMAN, xrefs: 009AA4DC
InstallationDate, xrefs: 009AA736
/CHECKINSTALL, xrefs: 009AA5D0
/CHECKSUB, xrefs: 009AA3A2
/OPENREGURL, xrefs: 009AA355
mm-dd-yyyy, xrefs: 009AA6FD
/CHECKUPDATE, xrefs: 009AA2F1
/COLLECT, xrefs: 009AA404
SOFTWARE\PC HelpSoft Driver Updater, xrefs: 009AA73B
/DRIVER, xrefs: 009AA89E
/uninstall, xrefs: 009AA29E
/JUSTSCA, xrefs: 009AA8EF
/RESTART, xrefs: 009AA815
/INSTALL, xrefs: 009AA69E
/UNINSTALLMAN, xrefs: 009AA556

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID:
String ID: /CHECKINSTALL$/CHECKSUB$/CHECKUPDATE$/COLLECT$/DRIVER$/INSTALL$/JUSTSCA$/OPENREGURL$/OPTIONS$/REPAIR$/RESTART$/STARTMAN$/UNINSTALLMAN$/uninstall$InstallationDate$PC HelpSoft Driver Updater$PCHelpSoftDriverUpdater$SOFTWARE\PC HelpSoft Driver Updater$mm-dd-yyyy
API String ID: 0-2328019585
Opcode ID: 41dae8a845e817c2290e372f06fbd6d64bc6c0ac8697d170fe19c0a46723ea6e
Instruction ID: 26b39a550285db20f71faa19560ebd98f125139ba8096f26770a2237b0884562
Opcode Fuzzy Hash: 41dae8a845e817c2290e372f06fbd6d64bc6c0ac8697d170fe19c0a46723ea6e
Instruction Fuzzy Hash: 65E19331B952049FD711EB69DC41FAE37E5EB8A314F404066F5009B3A2CB789C90DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 009669E0, Relevance: 44.2, APIs: 6, Strings: 19, Instructions: 480
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,0000020A,00000000,0096722A,?,?,?,?,00000000,00000000,?,009AA6C3,00000000,009AA75F,?,00000000), ref: 00966A5D
GetSystemDirectoryW.KERNEL32(?,0000020A), ref: 00966AA3
SHGetFolderPathW.SHFOLDER(00000000,00000026,00000000,00000000,?,?,0000020A,?,0000020A,00000000,0096722A,?,?,?,?,00000000), ref: 00966AEC
SHGetFolderPathW.SHFOLDER(00000000,0000001A,00000000,00000000,?,00000000,00000026,00000000,00000000,?,?,0000020A,?,0000020A,00000000,0096722A), ref: 00966B35
SHGetFolderPathW.SHFOLDER(00000000,00000023,00000000,00000000,?,?,?,?,?,00000000,00000000,?,009AA6C3,00000000,009AA75F), ref: 00966E87
GetLastError.KERNEL32(?,0096728C,00000000,00000000,009670AE,?,00000001,?,?,00000000,00000023,00000000,00000000,?), ref: 0096708A

Strings

Driver\, xrefs: 00966BCB
program_error.log, xrefs: 00966DC0
BackupPath, xrefs: 00966EC8
PC HelpSoft Driver Updater, xrefs: 00966B85, 00966BA3, 00966F07, 00966F28, 00966F88, 00966FA9
TryOpenIniFile failed, xrefs: 00967090
Scan.ini, xrefs: 00966CD0
\Drivers\, xrefs: 00966F8D, 00966FAE
program_c.log, xrefs: 00966D70
\Backup\, xrefs: 00966F0C, 00966F2D
program_c_error.log, xrefs: 00966E10
report-fatal.zip, xrefs: 00966E60
Devices.ini, xrefs: 00966C30
DevicesPlus.ini, xrefs: 00966C80
DownloadPath, xrefs: 00966F48
Language, xrefs: 00966FC4
program.log, xrefs: 00966D20
SOFTWARE\PC HelpSoft Driver Updater, xrefs: 00966ECD, 00966F4D, 00966FC9
English.ini, xrefs: 00967002
AssignFolders, xrefs: 00967095

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FolderPath$Directory$ErrorLastSystemWindows
String ID: AssignFolders$BackupPath$Devices.ini$DevicesPlus.ini$DownloadPath$Driver\$English.ini$Language$PC HelpSoft Driver Updater$SOFTWARE\PC HelpSoft Driver Updater$Scan.ini$TryOpenIniFile failed$\Backup\$\Drivers\$program.log$program_c.log$program_c_error.log$program_error.log$report-fatal.zip
API String ID: 1370629039-2661437840
Opcode ID: af6200f227167f0f3d3b212befc473c7514162c04f8718fee0ec6877c4d43eb5
Instruction ID: a0238c9c4605984cc8f75d27f18432ceefdbcbfc02a7e2b7328fbdfd804b77b4
Opcode Fuzzy Hash: af6200f227167f0f3d3b212befc473c7514162c04f8718fee0ec6877c4d43eb5
Instruction Fuzzy Hash: 7922A030655219DFCB20EB54DC8ABC9B3B5EF48308F5041E6F508AB2A5DB78AE85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0097174C, Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 200
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IcmpCreateFile.IPHLPAPI ref: 009717A3
GetLastError.KERNEL32(00000000,00000000,00971A47,?,?,00987FCF), ref: 009717B3
WSAStartup.WSOCK32(00000101,?,00000000,00971A47,?,?,00987FCF), ref: 00971803
GetLastError.KERNEL32(?,00000000,00000000,00000101,?,00000000), ref: 00971833
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00971851

Strings

IcmpCreateFile fail, xrefs: 009717B9
XInternet.PingHost, xrefs: 009717BE, 0097183E, 0097190F, 0097193E
WSAStartup fail, xrefs: 00971839
IcmpSendEcho fail, xrefs: 00971939
IcmpSendEcho timeout for , xrefs: 009718FF

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorIcmpLast$CloseCreateFileHandleStartup
String ID: IcmpCreateFile fail$IcmpSendEcho fail$IcmpSendEcho timeout for $WSAStartup fail$XInternet.PingHost
API String ID: 1017700833-2737738847
Opcode ID: 624373510c54387eba0869f5ee825a07c61a049152f84093a0e0f1de0cb69217
Instruction ID: 40a597fc889a187608018f6e0ff60e42327cd7ff997cdd9f0dcbc3cc69ec6ef4
Opcode Fuzzy Hash: 624373510c54387eba0869f5ee825a07c61a049152f84093a0e0f1de0cb69217
Instruction Fuzzy Hash: 49811AB1E00219DFCB14EF99C845AEEB7B4EF48304F0085AAE118E7651D7789E81DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D45C, Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D681,?,?), ref: 0040D495
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D681,?,?), ref: 0040D4DE
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D681,?,?), ref: 0040D500
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040D51E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040D53C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040D55A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040D578
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040D664,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D681), ref: 0040D5B8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040D664,?,80000001), ref: 0040D5E3
RegCloseKey.ADVAPI32(?,0040D66B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040D664,?,80000001,Software\Embarcadero\Locales), ref: 0040D65E

Strings

Software\Embarcadero\Locales, xrefs: 0040D4D4, 0040D4F6
Software\Borland\Locales, xrefs: 0040D550
Software\CodeGear\Locales, xrefs: 0040D514, 0040D532
Software\Borland\Delphi\Locales, xrefs: 0040D56E

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 38422511e293e455d82599edf3ace26ddf343796c7f78a471dcbb33ad021a8a9
Instruction ID: cb5fee359e33c40f42da520f887eb1c8d7238ca8925a212f965412b586eb314d
Opcode Fuzzy Hash: 38422511e293e455d82599edf3ace26ddf343796c7f78a471dcbb33ad021a8a9
Instruction Fuzzy Hash: 72512475E4020CBEEB10EAE5CC42FAE73ACDB48704F610476BA14F61C1D678AA549A5D

Uniqueness

Uniqueness Score: -1.00%

Function 0097F1AC, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 160
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B,?,?,00000000), ref: 0097F1F2
GetLastError.KERNEL32(00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B,?,?,00000000), ref: 0097F200
GetProcessTimes.KERNEL32(00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B,?,?,00000000), ref: 0097F26C
GetLastError.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B), ref: 0097F288
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B,?,?), ref: 0097F2B3
FileTimeToLocalFileTime.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B), ref: 0097F2C0
GetLastError.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000), ref: 0097F2D0

Part of subcall function 00976CF8: GetLastError.KERNEL32(?,?,00000000), ref: 00976D50

FileTimeToSystemTime.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346), ref: 0097F2FC
GetLastError.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346), ref: 0097F30C

Strings

OpenProcess fail, xrefs: 0097F237
GetProcessTimes fail, xrefs: 0097F28E
FileTimeToLocalFileTime fail, xrefs: 0097F2D6
FileTimeToSystemTime fail, xrefs: 0097F312
XProcess.GetProcessStartTime, xrefs: 0097F23C, 0097F293, 0097F2DB, 0097F317

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$Time$File$Process$CloseHandleLocalOpenSystemTimes
String ID: FileTimeToLocalFileTime fail$FileTimeToSystemTime fail$GetProcessTimes fail$OpenProcess fail$XProcess.GetProcessStartTime
API String ID: 1941282559-3664409035
Opcode ID: 0e068061912b0c1fb626686e4ec9b55dc5a612205e470a27f8575ff8fa540bd7
Instruction ID: a28d9122cd8be31b0b20070e31157dc20af68181f26803e3dcdf25940512e78a
Opcode Fuzzy Hash: 0e068061912b0c1fb626686e4ec9b55dc5a612205e470a27f8575ff8fa540bd7
Instruction Fuzzy Hash: 325181B29042089FDB14EBE4D861AAEB7FCFB88700F51843AF119F7651EA749D01CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0097ECB0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,00000000,0097EFBE), ref: 0097ED27
CloseHandle.KERNEL32(00000000,00000000,00000000,?,0000020A,00000410,00000000,00000000,00000000,0097EFBE), ref: 0097ED7B
GetLastError.KERNEL32(?,00000000,00000000,0000020A,00000410,00000000,00000000,00000000,0097EFBE), ref: 0097EDFE
CloseHandle.KERNEL32(00000000,0000020A,00000410,00000000,00000000,00000000,0097EFBE), ref: 0097EEE3
GetLastError.KERNEL32(00000410,00000000,00000000,00000000,0097EFBE), ref: 0097EF21

Strings

GetPathFromPID, xrefs: 0097EE09, 0097EE88, 0097EED0, 0097EF10, 0097EF5D
GetModuleFileNameEx fail, xrefs: 0097EE04
OpenProcess fail, xrefs: 0097EF58
GetProcessImageFileName 2 fail, xrefs: 0097EECB
GetProcessImageFileName 1 fail, xrefs: 0097EE83
Result empty, xrefs: 0097EF0B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$OpenProcess
String ID: GetModuleFileNameEx fail$GetPathFromPID$GetProcessImageFileName 1 fail$GetProcessImageFileName 2 fail$OpenProcess fail$Result empty
API String ID: 1983333313-1316136917
Opcode ID: 01f23a06fb8a4cd7fb5ad9baa7e0492bcafa66d21f3ecb5e51035b74d58fd211
Instruction ID: b1017b60c1efba1bfb4391ec36676ff5dbe3c0646c2f08ef568b96d59fe7f42e
Opcode Fuzzy Hash: 01f23a06fb8a4cd7fb5ad9baa7e0492bcafa66d21f3ecb5e51035b74d58fd211
Instruction Fuzzy Hash: 8C915F72A04208EFDB14EB99DC45BAEB7B9EF88304F5185E5F508AB691C7349E80CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6A4, Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040E75C

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 8e95b802f9ed84cc0071b751e837a8c1ce4a3ed0ad44c2a38b21d9a505767573
Instruction ID: 952a97e85d2106704a2c17765baf1861159145f213fb4572cfefdbf0851cf753
Opcode Fuzzy Hash: 8e95b802f9ed84cc0071b751e837a8c1ce4a3ed0ad44c2a38b21d9a505767573
Instruction Fuzzy Hash: DAA1A1729103099FDB14DFAAD880BDEB7B5BB48310F14892AE545BB390DB74A941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0097D490, Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005D3F64: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005D3F75

Part of subcall function 00424AF0: GetLocalTime.KERNEL32(?), ref: 00424AF8

Part of subcall function 005D3F84: Process32FirstW.KERNEL32(000000FF,?), ref: 005D3F95

CloseHandle.KERNEL32(000000FF), ref: 0097D6AE

Part of subcall function 0097ECB0: OpenProcess.KERNEL32(00000410,00000000,00000000,00000000,0097EFBE), ref: 0097ED27
Part of subcall function 0097ECB0: CloseHandle.KERNEL32(00000000,00000000,00000000,?,0000020A,00000410,00000000,00000000,00000000,0097EFBE), ref: 0097ED7B

Strings

Start=, xrefs: 0097D666
Visible=, xrefs: 0097D63F
, xrefs: 0097D5FF
---------------------------------------, xrefs: 0097D51C
Parent=, xrefs: 0097D61F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateFirstLocalOpenProcessProcess32SnapshotTimeToolhelp32
String ID: $ Parent=$ Start=$ Visible=$ ---------------------------------------
API String ID: 2050650819-253325831
Opcode ID: 20d841608ce40028ac56a429f6713b5177aede36dc2f8e23c8fbe1aa8341c547
Instruction ID: 8880f0b78f542825acc02780dd712d6d0a8829bd4ee421ab64ddaea51f81d1f6
Opcode Fuzzy Hash: 20d841608ce40028ac56a429f6713b5177aede36dc2f8e23c8fbe1aa8341c547
Instruction Fuzzy Hash: 12616A75A0221A9FCB14EF94DC45AEEB7B5FF88308F1084AAE408B3251DB755E45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004220C4, Relevance: 9.1, APIs: 6, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,?,?,00000000,0097BB75), ref: 004220DA
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,00000000,0097BB75), ref: 00422119
CloseHandle.KERNEL32(00000000,00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,00000000,0097BB75), ref: 00422124
GetLastError.KERNEL32(00000000,?,?,?,?,00000000,0097BB75), ref: 0042216B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCreateErrorHandleLast
String ID:
API String ID: 2927643983-0
Opcode ID: 938878f4fce098e72b979eaa482619571c5382bbcfc06812f22d948834ebce21
Instruction ID: 42504638dff81c01478ff505a3a8c0fcaaaacdb9621f118f2cb89acc469e908e
Opcode Fuzzy Hash: 938878f4fce098e72b979eaa482619571c5382bbcfc06812f22d948834ebce21
Instruction Fuzzy Hash: 2311B23174523434F63815697E96FBF11084B06324FB90A27FB65BA2D5C1DC9EB2605E

Uniqueness

Uniqueness Score: -1.00%

Function 005B772C, Relevance: 7.6, APIs: 5, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(005B7620,00000000), ref: 005B776A
ShowWindow.USER32(?,00000000,005B7620,00000000), ref: 005B77AC
ShowOwnedPopups.USER32(00000000,?,005B7620,00000000), ref: 005B77DB
ShowWindow.USER32(?,00000005), ref: 005B7850
ShowOwnedPopups.USER32(00000000,?), ref: 005B787F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Show$OwnedPopupsWindow$EnumWindows
String ID:
API String ID: 315437064-0
Opcode ID: 8536b32c5f331092f5772ebcd2f3178cd4d25345c038292411b0f1b336e633ca
Instruction ID: 7bfca22384dc7443694192eda1dfaaba541f40024d7f74d5fd3ff5b8194336fb
Opcode Fuzzy Hash: 8536b32c5f331092f5772ebcd2f3178cd4d25345c038292411b0f1b336e633ca
Instruction Fuzzy Hash: C8411C31608A458FD720DB28C888BE67BE6FBD8358F15096AE45AC72A5D734BC81DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0042202C, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D
GetLastError.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 00422096

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 70e4cd07921f946c6c1045029ce91172357a88bacaf60b1e8b6433cf14b40008
Instruction ID: ea73ddf321e102643fa493cb3c86e39c8a10444d63d624ae0d132597932a2626
Opcode Fuzzy Hash: 70e4cd07921f946c6c1045029ce91172357a88bacaf60b1e8b6433cf14b40008
Instruction Fuzzy Hash: 0101BC3534023071EA3524792F86BBB41440B567A8FA80617FB12A72E2D7CE5883E16F

Uniqueness

Uniqueness Score: -1.00%

Function 004224B8, Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,?,?,00000000,0097BADA), ref: 004224C8
GetLastError.KERNEL32(00000000,?,?,?,00000000,0097BADA), ref: 004224D7
GetFileAttributesW.KERNEL32(00000000,00000000,?,?,?,00000000,0097BADA), ref: 004224DF
RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,?,00000000,0097BADA), ref: 004224FA
SetLastError.KERNEL32(00000000,00000000,00000000,?,?,?,00000000,0097BADA), ref: 00422508

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorFileLast$AttributesDeleteDirectoryRemove
String ID:
API String ID: 2814369299-0
Opcode ID: faff08a3d6ca9d9b95671e769a703ddb82c1cece7a41834bd1e805e456aedb6e
Instruction ID: e306ca6f9c8d4864558ae8baad4498ced178c69cbe5a65039468ec139708e13a
Opcode Fuzzy Hash: faff08a3d6ca9d9b95671e769a703ddb82c1cece7a41834bd1e805e456aedb6e
Instruction Fuzzy Hash: ECF027213012643AA520397E2E91ABF214CC94236DF40063BFA40D3292C69E9EC6616E

Uniqueness

Uniqueness Score: -1.00%

Function 00976CF8, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 005D3F64: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005D3F75

GetLastError.KERNEL32(?,?,00000000), ref: 00976D50
CloseHandle.KERNEL32(000000FF), ref: 00976DAF

Strings

CheckProcessRunning, xrefs: 00976D5B
CreateToolhelp32Snapshot fail, xrefs: 00976D56

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CloseCreateErrorHandleLastSnapshotToolhelp32
String ID: CheckProcessRunning$CreateToolhelp32Snapshot fail
API String ID: 256649917-331305056
Opcode ID: 6fb3cac6e9e8bffe9612580167a21f43e47da0d962c6a4a44661c47a457f0118
Instruction ID: be1ee6b3471ba934a25aae0338d1fabd924715f79b23bcfc53456d7e50272353
Opcode Fuzzy Hash: 6fb3cac6e9e8bffe9612580167a21f43e47da0d962c6a4a44661c47a457f0118
Instruction Fuzzy Hash: E021A131E14608ABDB20EB69CC49A9DB7F9EF84300F50C1B6E408A7291D7789F40CB11

Uniqueness

Uniqueness Score: -1.00%

Function 004CBAB8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,006B7F33,00000000,00000000,?,?,00000000), ref: 004CBAE3

Strings

License, xrefs: 004CBAB8
4EA, xrefs: 004CBB02

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: 4EA$License
API String ID: 3660427363-986393733
Opcode ID: 77dc5d9cfade92e4977ae56f040fb5fd2ee996507e62b2326060335367b29b61
Instruction ID: 0efba13403aef6f202e5189d515853a7678c4e090507596da65e686ad18909e7
Opcode Fuzzy Hash: 77dc5d9cfade92e4977ae56f040fb5fd2ee996507e62b2326060335367b29b61
Instruction Fuzzy Hash: 2B019235704208ABCB00EEA9DC81EDEB7ACAB45318F00816BF904D7341D6359E0497A5

Uniqueness

Uniqueness Score: -1.00%

Function 004CBA44, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000000,?,?,?), ref: 004CBA76

Strings

MachineGuid, xrefs: 004CBA44
<EA, xrefs: 004CBA95

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Value
String ID: <EA$MachineGuid
API String ID: 3702945584-1924474783
Opcode ID: 0d7a9cd2fe4dc5423cb5b1a8bc64d927aaea25b842a61d50cc2ba3fc3067776a
Instruction ID: e3ea5282cb5655746fc194130ca5d7e988396f381b856dcbbaec1957e6ffb3c6
Opcode Fuzzy Hash: 0d7a9cd2fe4dc5423cb5b1a8bc64d927aaea25b842a61d50cc2ba3fc3067776a
Instruction Fuzzy Hash: D801D635A041087BCB40EBAE9C81F9FB7EC9B48358F00806AFA18D7341D6399D0097A9

Uniqueness

Uniqueness Score: -1.00%

Function 004CAE38, Relevance: 4.6, APIs: 3, Instructions: 150registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004CAFFB), ref: 004CAEB1
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,004CAFFB), ref: 004CAF27
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004CAF98

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 79224f40ad66a90e4010e31c98b17feffbb2c195a738abebc30024a39b64aa25
Instruction ID: 697082d2ecaf39a36962cbd12f5aa494e0538655d6369675ce8a5f4f1366f588
Opcode Fuzzy Hash: 79224f40ad66a90e4010e31c98b17feffbb2c195a738abebc30024a39b64aa25
Instruction Fuzzy Hash: AC516074B00208AFDB51EBA5C942F9FB7F9AB44308F14446EE404A7382D77D9F15A78A

Uniqueness

Uniqueness Score: -1.00%

Function 00409B0C, Relevance: 4.6, APIs: 3, Instructions: 91threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00409B38
FreeLibrary.KERNEL32(00400000,?,00000000,?,00000000,00409C4E,00409C68,?,?,0040E5FC,?,0040E62B,00000000,00406CF1,0040952C,004281EC), ref: 00409BEA
ExitProcess.KERNEL32(00000000,?,00000000,?,00000000,00409C4E,00409C68,?,?,0040E5FC,?,0040E62B,00000000,00406CF1,0040952C,004281EC), ref: 00409C26

Part of subcall function 00409A74: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409B28,?,00000000,?,00000000,00409C4E,00409C68,?,?,0040E5FC), ref: 00409AAD
Part of subcall function 00409A74: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409B28,?,00000000,?,00000000,00409C4E,00409C68), ref: 00409AB3
Part of subcall function 00409A74: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409B28,?,00000000,?), ref: 00409ACE
Part of subcall function 00409A74: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409B28,?,00000000), ref: 00409AD4

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: a058b5c9bac5bbb4e52be2921a8f673b0b4c1b852097283ae41ccbfa4efde1fa
Instruction ID: 2d6ee482d0a92e78f694ed2fd6c735788198341fc9c3b42518bcd7f2df564a61
Opcode Fuzzy Hash: a058b5c9bac5bbb4e52be2921a8f673b0b4c1b852097283ae41ccbfa4efde1fa
Instruction Fuzzy Hash: F9314A709197408BEB31ABA9E84936A77E4BB24328F04053FE485A72D3C77CACC4C759

Uniqueness

Uniqueness Score: -1.00%

Function 004CAD04, Relevance: 3.1, APIs: 2, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000100,00000000,00000000,004CAE15,?,?,00000000), ref: 004CAD7E
RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000100,00000000,00000000,00975609,00000000,004CAE15,?,?,00000000), ref: 004CADB8

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: b17db04b675acbb46ba4dff7f717d737ebef4b2d6eb60c0bb6de41d4e2767712
Instruction ID: 9f0601c02c61521bf54137887bd2464cb4ffb4cb6df401671ed615be465fdcd1
Opcode Fuzzy Hash: b17db04b675acbb46ba4dff7f717d737ebef4b2d6eb60c0bb6de41d4e2767712
Instruction Fuzzy Hash: 81318174B0420CAFDB51EBA9C842F9FB7E9AB04308F10447EF501E7682DA789E15975A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA3C, Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040DB53,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040DBDA,00000000,?,00000105), ref: 0040DAE7
GetSystemDefaultUILanguage.KERNEL32(00000000,0040DB53,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040DBDA,00000000,?,00000105), ref: 0040DB0F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: cf4944142b7adaec2cd5676eb94624b5f5841059967563b45aa80dd35651ed14
Instruction ID: b486bee8a5ccadd4e6282806d82bc12d1ab35860a2570ada9f63636cc4605989
Opcode Fuzzy Hash: cf4944142b7adaec2cd5676eb94624b5f5841059967563b45aa80dd35651ed14
Instruction Fuzzy Hash: 38312A70E102099BDB10EBD9C882BAEB7B5EF48308F51457BE400B32D1DB78AD49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60, Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040DC1A,?,?,00000000,?,0040C914,?,?,0000020A,?,00000000,0040C955), ref: 0040DB9C
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040DC1A,?,?,00000000,?,0040C914,?,?,0000020A), ref: 0040DBED

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 10a6daad9b0cf7631519d987518601c5e773a9a98995f4ec9b61c2ba5bb44bfd
Instruction ID: dd9343a666e2ea5e253315eaf08330bf70b9a5e934c864bfb2519e9d0d00fdeb
Opcode Fuzzy Hash: 10a6daad9b0cf7631519d987518601c5e773a9a98995f4ec9b61c2ba5bb44bfd
Instruction Fuzzy Hash: DF119171A4421C9BDB14EB90CC86BDE73B8EB48304F5104BAB508B32D1DA785F849AA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041208C, Relevance: 3.0, APIs: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 004120B0
GetProcAddress.KERNEL32(?,00000000), ref: 004120D2

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 99b6045b3a6b9f017f32236c34c783bd0af6529556a434a6d0e49265cce80da4
Instruction ID: 13501311de8b34c05c245211d8a0b73c91e1b276a843aca21d112aefe7b35c8a
Opcode Fuzzy Hash: 99b6045b3a6b9f017f32236c34c783bd0af6529556a434a6d0e49265cce80da4
Instruction Fuzzy Hash: 38F09630704208BFD711EA55CD42A9E779CEB4D714F51417AFA00E3282D6B86D61C5A9

Uniqueness

Uniqueness Score: -1.00%

Function 004CAC6C, Relevance: 3.0, APIs: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegFlushKey.ADVAPI32(00010000,004C9AFC,004CACC3,004C9AFC,00000001,004CAC0E,?,?,009699A7,00000000,0096AB72,?,000000A3,00000000,00000000), ref: 004CAC7D
RegCloseKey.ADVAPI32(00010000,004C9AFC,004CACC3,004C9AFC,00000001,004CAC0E,?,?,009699A7,00000000,0096AB72,?,000000A3,00000000,00000000), ref: 004CAC86

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 559e432d3726c8caf0ab7425167987b766a7fab6952abc22ca8f1f5991f93ad1
Instruction ID: b261b006542ddc29ad2a8f1b4ed1ccfd4a6d0deb0e6368f62aa6488b455c6591
Opcode Fuzzy Hash: 559e432d3726c8caf0ab7425167987b766a7fab6952abc22ca8f1f5991f93ad1
Instruction Fuzzy Hash: CCD017B46002058BDF90EF7AC9C4B477BD86F04348B08C4ABA908CF257EA38DC508B25

Uniqueness

Uniqueness Score: -1.00%

Function 004CAE34, Relevance: 1.6, APIs: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004CAFFB), ref: 004CAEB1

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9eda780b24ce36362a0ae5e37cd11702fd802a79bcbf7a3644551fd4defe1140
Instruction ID: 5b734bf4fc03649d03009c94780cc3fa15c30dd7de5d8c21600b75ccb9466ea2
Opcode Fuzzy Hash: 9eda780b24ce36362a0ae5e37cd11702fd802a79bcbf7a3644551fd4defe1140
Instruction Fuzzy Hash: D621A134A04208AFDB51EBA5C852F9FB7F9EB44308F21447EE404E3792D63D9E15974A

Uniqueness

Uniqueness Score: -1.00%

Function 00409774, Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,004097C2,?,00000000,009D4B1C,00000000,?,00409BBD,?,00000000,?,00000000,00409C4E,00409C68), ref: 004097B2

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: d12499d1a7d1416551050b2933bbcedec558ef96fdee9888cae94c72d9bc50be
Instruction ID: 6655b363c79301fad88b35c281dec6540dcc38cb330ae0daa38d54013ae70ffe
Opcode Fuzzy Hash: d12499d1a7d1416551050b2933bbcedec558ef96fdee9888cae94c72d9bc50be
Instruction Fuzzy Hash: 5BF09633226605DFD3214F0AA9C0757B7DCF759760756003BD804A3692D378DC40C564

Uniqueness

Uniqueness Score: -1.00%

Function 004CB5B8, Relevance: 1.5, APIs: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,004CBB62,?,?,?,?,004CBB62), ref: 004CB5E9

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 61ec06d8b01221c04fd75fe602f73208140e788be0c124307e9c6b7c48eb2c7c
Instruction ID: 822ba114e09c931b725da73c3f825071d6b9070daf3bee6f3cdd93595a4d3e1a
Opcode Fuzzy Hash: 61ec06d8b01221c04fd75fe602f73208140e788be0c124307e9c6b7c48eb2c7c
Instruction Fuzzy Hash: 49F030763082046FD744EA6E9C81F6B66DCDB88714F14843FB249D7242D928DC059376

Uniqueness

Uniqueness Score: -1.00%

Function 00421C40, Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,000000F0,000000F0,00000000,00000003,00000080,00000000,?,00000000,0047B8C8,0049B658,00000000,0049B6D8,?,?,0047B8C8), ref: 00421C8F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 392ff22b6999f41dbf74e461c52f235a7a6fd9f21ca7b59d9e78cd34b3b819f1
Instruction ID: 2c62eb8943a79affaf72b8a7c0497d584c1be56f4233926d679bf074253f73e8
Opcode Fuzzy Hash: 392ff22b6999f41dbf74e461c52f235a7a6fd9f21ca7b59d9e78cd34b3b819f1
Instruction Fuzzy Hash: ABE061B2F501202BF720695EFC91F5B614D8792779F050132F304EB2D1C068DC0192AC

Uniqueness

Uniqueness Score: -1.00%

Function 00420CC4, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000400,00000001,00000000,?,00000000,?,?,00000000,?,?,0042607C,?,?,?,00000000,004260E6), ref: 00420CFB

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 2c9e1a5da420870130dd61c306953b363b7a20a3afd03a41fcca15fbeffc0c64
Instruction ID: 56a5642607ffc5b0c79ee8e7def8e450a920c628ddc59d323d0c0dc700c4dac7
Opcode Fuzzy Hash: 2c9e1a5da420870130dd61c306953b363b7a20a3afd03a41fcca15fbeffc0c64
Instruction Fuzzy Hash: 20E092E370132427A52055AF1CC1F67668C8B856A4F06023AFF04F7646C5556C01A1A8

Uniqueness

Uniqueness Score: -1.00%

Function 00421CA8, Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,?,00000000,0047B8C8,0049B5ED,00000000,0049B6D8,?,?,0047B8C8), ref: 00421CF1

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5daf96f731c48a11e202e24dcf6f6cdeb818c517c31fb522fd0fd61a7c069e47
Instruction ID: 5a9845da35a77086fc7107a2d3808665b3c28ccacf14a0632c084ca2b4926aff
Opcode Fuzzy Hash: 5daf96f731c48a11e202e24dcf6f6cdeb818c517c31fb522fd0fd61a7c069e47
Instruction Fuzzy Hash: 2BE0D8E3F1012027F610669EAC81F5B614C8B417B9F060536FB11DB2D1C054DC1052E8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E8, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A,?,00000000,0040C955,0041B4CC,?,?,0040E354,00010000,00001000,00001000), ref: 0040C906

Part of subcall function 0040DB60: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040DC1A,?,?,00000000,?,0040C914,?,?,0000020A,?,00000000,0040C955), ref: 0040DB9C
Part of subcall function 0040DB60: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040DC1A,?,?,00000000,?,0040C914,?,?,0000020A), ref: 0040DBED

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 541db8c03e8d25627d20ee499dca87d58b2a82bfab76723142b21a629862c834
Instruction ID: 2c0b8d9275144a6f29f6975400dec7db8c3e179cca4e468066f048c90477d369
Opcode Fuzzy Hash: 541db8c03e8d25627d20ee499dca87d58b2a82bfab76723142b21a629862c834
Instruction Fuzzy Hash: 86E0EDB2A003109BCB10DFA8D8C5A4737E8BB08754F044A66AD54DF396D379DD1487D5

Uniqueness

Uniqueness Score: -1.00%

Function 0097D450, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

EnumWindows.USER32(0097D40C,00000000), ref: 0097D47A

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 76d6534bc7014f0a67e9f24b3eb502238a2439a9640b1ebb8b3bca8a9a889a86
Instruction ID: 1f09407f59e82469e8c4a9b3a42182d49b451aa01d9b67f028602af3803147ec
Opcode Fuzzy Hash: 76d6534bc7014f0a67e9f24b3eb502238a2439a9640b1ebb8b3bca8a9a889a86
Instruction Fuzzy Hash: 5CE09225A9E3C89DC711CBA86C12BDD7FB14B26110F1400DBD494673D2D1791712E7A7

Uniqueness

Uniqueness Score: -1.00%

Function 005D3F84, Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 005D3BA0: GetModuleHandleW.KERNEL32(kernel32.dll,00000002,005D3F6F,00000000,?,0097D4ED,00000000,0097D6BD,?,00000000,0097D712,?,?,00000000), ref: 005D3BB4

Process32FirstW.KERNEL32(000000FF,?), ref: 005D3F95

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FirstHandleModuleProcess32
String ID:
API String ID: 2633820271-0
Opcode ID: 7bafed4fbb0349c97051aaa5cab636dc8a79442bf2567a6fad8a88972d6f4f42
Instruction ID: 5d910a2422922ffd160525786d03ebfb0d580f7772678c8a7576edc354c781b4
Opcode Fuzzy Hash: 7bafed4fbb0349c97051aaa5cab636dc8a79442bf2567a6fad8a88972d6f4f42
Instruction Fuzzy Hash: D1C08072626624575B3077FD2D8C4C74B4DDD451B23080463F508D3201F2554D0052F0

Uniqueness

Uniqueness Score: -1.00%

Function 0042294C, Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000001,00422272,00000000,00422297,?,00000000,00000000,00000000,00000000,00000000,?,00985730,00000000,0098575F), ref: 00422959

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 022edc40d1803eab289424500c324dc959b6aa0b03df0d20d6716ec6f7b348a9
Instruction ID: f1beff088d7b771a414cfd9033c616504088634d68ad5495b18351c25d83db32
Opcode Fuzzy Hash: 022edc40d1803eab289424500c324dc959b6aa0b03df0d20d6716ec6f7b348a9
Instruction Fuzzy Hash: 1DB092A2B543401AEA0076BA1CC2B2A008C9B0460AF20093AB202D6192D56AD8542069

Uniqueness

Uniqueness Score: -1.00%

Function 004AA368, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,?,?,00502FD3,00505550,?,?,?,00000000,?,005AD5D3), ref: 004AA386

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7db192208dbb12fccedcdac80ac930968fd60e87b2f0c5c2f3b86bec7e696011
Instruction ID: da7b2ca7fdd08739f41208bfe49e987d90af6638686082190b257701d7bdcfde
Opcode Fuzzy Hash: 7db192208dbb12fccedcdac80ac930968fd60e87b2f0c5c2f3b86bec7e696011
Instruction Fuzzy Hash: A71188342443059BCB20DF5AC881B82FBE5EB99350F14C53BE9998B385D374E814CBA6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0096C988, Relevance: 293.9, APIs: 30, Strings: 137, Instructions: 1695COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,?,00000000,0096E798), ref: 0096D052

Strings

m, xrefs: 0096D748
i, xrefs: 0096D5D8
InternetSetFilePointer fail 1, xrefs: 0096E0BA
InternetSetFilePointer fail 2, xrefs: 0096E284
InternetQueryOption 2 fail, xrefs: 0096D20F
o, xrefs: 0096D6D8
HttpSendRequest timeout, xrefs: 0096D8AD
HttpQueryInfo HTTP_QUERY_STATUS_CODE fail: , xrefs: 0096DBDB
o, xrefs: 0096CBE3
, WinInetTimeout=, xrefs: 0096E24C, 0096E35B, 0096E4B4, 0096E6BE
Accept: */*, xrefs: 0096D29A
fail: , xrefs: 0096DDA9
HttpQueryInfo HTTP_QUERY_CONTENT_LENGTH fail: , xrefs: 0096DF04
Cancelled 1: , xrefs: 0096E109
, DataSize=, xrefs: 0096E2EE, 0096E462
HttpSendRequest switch to ip (not resolved): , xrefs: 0096D52A, 0096D79E
a, xrefs: 0096CB13
s, xrefs: 0096D658
94.130.13.99, xrefs: 0096CC2B, 0096CE58, 0096D777, 0096D7F0
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 0096CC0E
InternetReadFile timeout first, Data.Size=, xrefs: 0096E182
c, xrefs: 0096D728
, ERROR_INTERNET_NAME_NOT_RESOLVED, xrefs: 0096DA53
d, xrefs: 0096CE7D
o, xrefs: 0096D6E8
InternetSetOption 2 fail, xrefs: 0096D279
Proxy-Connection: Keep-Alive, xrefs: 0096D2B4
e, xrefs: 0096CAC3
v, xrefs: 0096CE9D
o, xrefs: 0096D618
., xrefs: 0096CBC3
., xrefs: 0096CF8D
e, xrefs: 0096CA73
t, xrefs: 0096D5F8
HttpOpenRequest fail, xrefs: 0096D197
Cancelled 2: , xrefs: 0096E5D7
m, xrefs: 0096CFBD
., xrefs: 0096D648
r, xrefs: 0096CA63
HttpSendRequest fail 1: , xrefs: 0096D958
c, xrefs: 0096CA83
DataSize=, xrefs: 0096E682
Continue previous downloading, Data.Size=, xrefs: 0096E016
n, xrefs: 0096D628
b, xrefs: 0096D598
i, xrefs: 0096CAA3
m, xrefs: 0096CBF3
c, xrefs: 0096CB53
d, xrefs: 0096CB83
e, xrefs: 0096CA93
e, xrefs: 0096CF7D
a, xrefs: 0096CB93
o, xrefs: 0096D738
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 0096CFD8
s, xrefs: 0096CAF3
t, xrefs: 0096CF6D
HttpSendRequest timeout: , xrefs: 0096D9B1
c, xrefs: 0096D5B8
, IP:, xrefs: 0096D11E, 0096D166, 0096D963, 0096D9D7, 0096DA3D, 0096DA96, 0096DB03, 0096E087, 0096E1A1, 0096E236, 0096E345, 0096E3CE, 0096E49E
Pragma: no-cache, xrefs: 0096D28D
o, xrefs: 0096CFAD
Host: , xrefs: 0096D2D0
, ServerError: , xrefs: 0096D9BC, 0096E32A
, ERROR_INTERNET_CANNOT_CONNECT, xrefs: 0096D979
e, xrefs: 0096CBB3
InternetReadFile timeout final: , xrefs: 0096E2E3
r, xrefs: 0096CEED
Code , xrefs: 0096DD8C
u, xrefs: 0096CB63
r, xrefs: 0096CB23
ConnectToInternet fail, xrefs: 0096D058
DownloadingTest, xrefs: 0096E596
r, xrefs: 0096D5C8
i, xrefs: 0096D608
a, xrefs: 0096D678
u, xrefs: 0096D588
HttpSendRequest cannot connect, xrefs: 0096D8FD
%20, xrefs: 0096D0C5
Status code fail: , xrefs: 0096DE18
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 0096CE3B, 0096D50C, 0096D763
m, xrefs: 0096D668
t, xrefs: 0096CBA3
HttpSendRequest switch to http (ssl): , xrefs: 0096D826
Host=, xrefs: 0096D041, 0096D1F8, 0096D262
407: disabling preconfig, xrefs: 0096DC52
a, xrefs: 0096CF5D
Status code fail 407 Proxy Authentication Required: , xrefs: 0096DCA9, 0096DD14
HttpSendRequest fail 4: , xrefs: 0096DADD
p, xrefs: 0096CF0D
c, xrefs: 0096D6B8
, ERROR_INTERNET_SECURITY_CHANNEL_ERROR, xrefs: 0096DAAC, 0096E3E4
HttpOpenRequest timeout: , xrefs: 0096D113
XInternet.LoadInternetData, xrefs: 0096CA19, 0096D05D, 0096D14A, 0096D19C, 0096D214, 0096D27E, 0096D54B, 0096D7BF, 0096D860, 0096D8B2, 0096D902, 0096D994, 0096DA03, 0096DA6E, 0096DAC7, 0096DB48, 0096DBFC, 0096DC57, 0096DCE7, 0096DD52, 0096DDCA, 0096DE56, 0096DF25, 0096DF94, 0096E026, 0096E0BF, 0096E12A, 0096E1CD, 0096E289, 0096E38C, 0096E3FF, 0096E508, 0096E59B, 0096E5F8, 0096E702
p, xrefs: 0096CB73
Data.Size=, xrefs: 0096E068, 0096E217
Not secure, xrefs: 0096CA14
}/, xrefs: 0096E3B2
e, xrefs: 0096CE8D
Connection: Keep-Alive, xrefs: 0096D2A7
Data.Size=, xrefs: 0096E69F
d, xrefs: 0096CF4D
t, xrefs: 0096D6C8
, Data.Size=, xrefs: 0096E30B, 0096E47F
InternetReadFile fail 1: , xrefs: 0096E3C3
m, xrefs: 0096CECD
m, xrefs: 0096CB03
c, xrefs: 0096CBD3
HttpSendRequest fail 2: , xrefs: 0096DA32
r, xrefs: 0096D688
s, xrefs: 0096D5A8
s, xrefs: 0096CEBD
p, xrefs: 0096D5E8
., xrefs: 0096CAE3
s, xrefs: 0096D708
HttpSendRequest fail 3: , xrefs: 0096DA8B
l, xrefs: 0096D6F8
v, xrefs: 0096CAB3
Fail, xrefs: 0096E6FD
u, xrefs: 0096CF2D
136.243.82.24, xrefs: 0096CFF5
t, xrefs: 0096CEFD
r, xrefs: 0096CAD3
., xrefs: 0096D718
Path=, xrefs: 0096D15B
c, xrefs: 0096CF1D
s, xrefs: 0096D578
a, xrefs: 0096CEDD
s, xrefs: 0096D638
p, xrefs: 0096D6A8
p, xrefs: 0096CB43
., xrefs: 0096CEAD
p, xrefs: 0096CF3D
c, xrefs: 0096CF9D
InternetReadFile fail 2, xrefs: 0096E503
t, xrefs: 0096D698
Already downloaded: , xrefs: 0096DF73
t, xrefs: 0096CB33

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: Data.Size=$ fail: $%20$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$, Data.Size=$, DataSize=$, ERROR_INTERNET_CANNOT_CONNECT$, ERROR_INTERNET_NAME_NOT_RESOLVED$, ERROR_INTERNET_SECURITY_CHANNEL_ERROR$, IP:$, ServerError: $, WinInetTimeout=$.$.$.$.$.$.$136.243.82.24$407: disabling preconfig$94.130.13.99$Accept: */*$Already downloaded: $Cancelled 1: $Cancelled 2: $Code $ConnectToInternet fail$Connection: Keep-Alive$Continue previous downloading, Data.Size=$Data.Size=$DataSize=$DownloadingTest$Fail$Host: $Host=$HttpOpenRequest fail$HttpOpenRequest timeout: $HttpQueryInfo HTTP_QUERY_CONTENT_LENGTH fail: $HttpQueryInfo HTTP_QUERY_STATUS_CODE fail: $HttpSendRequest cannot connect$HttpSendRequest fail 1: $HttpSendRequest fail 2: $HttpSendRequest fail 3: $HttpSendRequest fail 4: $HttpSendRequest switch to http (ssl): $HttpSendRequest switch to ip (not resolved): $HttpSendRequest timeout$HttpSendRequest timeout: $InternetQueryOption 2 fail$InternetReadFile fail 1: $InternetReadFile fail 2$InternetReadFile timeout final: $InternetReadFile timeout first, Data.Size=$InternetSetFilePointer fail 1$InternetSetFilePointer fail 2$InternetSetOption 2 fail$Not secure$Path=$Pragma: no-cache$Proxy-Connection: Keep-Alive$Status code fail 407 Proxy Authentication Required: $Status code fail: $XInternet.LoadInternetData$a$a$a$a$a$b$c$c$c$c$c$c$c$c$d$d$d$e$e$e$e$e$e$i$i$i$l$m$m$m$m$m$m$n$o$o$o$o$o$o$p$p$p$p$p$p$r$r$r$r$r$r$s$s$s$s$s$s$s$t$t$t$t$t$t$t$u$u$u$v$v$}/
API String ID: 1452528299-1012387815
Opcode ID: 21a1392ad0ce51d22c0c078c5b24ac1117d7c9a106fdf47e912eb488a717dadc
Instruction ID: 000390f283cc8dbe46bcc683d4c7fb8fb59f7a229b838d1d37d05c36c3065bad
Opcode Fuzzy Hash: 21a1392ad0ce51d22c0c078c5b24ac1117d7c9a106fdf47e912eb488a717dadc
Instruction Fuzzy Hash: D5039D30904259DEDF20DB95DC49BEDBBB5AF54308F1040EAE1087B2A2D7B95E84CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0080E3A8, Relevance: 91.7, APIs: 36, Strings: 16, Instructions: 686encryptionCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,00000000,00001FFE,00000006,00000000,?,?,?,?,?,?), ref: 0080E462
GetLastError.KERNEL32(00000000,0080EC3F,?,00000000,0080EC64,?,?,00988675,00000000,00988728,?,00000000,00988765,?,00000000,00000000), ref: 0080E46B
GetLastError.KERNEL32(00000000,0080EC3F,?,00000000,0080EC64,?,?,00988675,00000000,00988728,?,00000000,00988765,?,00000000,00000000), ref: 0080E477
CryptMsgGetParam.CRYPT32(?,00000005,00000000,00000000,?), ref: 0080E4C8
GetLastError.KERNEL32(00000000,0080EC3F,?,00000000,0080EC64,?,?,00988675,00000000,00988728,?,00000000,00988765,?,00000000,00000000), ref: 0080E4D1
CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 0080E517
GetLastError.KERNEL32(?,00000005,00000000,?,?,00000000,0080EC3F,?,00000000,0080EC64,?,?,00988675,00000000,00988728), ref: 0080E520

Strings

CryptMsgGetParam 1 fail, xrefs: 0080E4DA
CryptMsgGetParam 4 fail, xrefs: 0080E610
CertFindCertificateInStore 1 fail, xrefs: 0080E712
CryptQueryObject fail, xrefs: 0080E480, 0080E957
CryptMsgGetParam 3 fail, xrefs: 0080E5BB
GetSignaturesInfo, xrefs: 0080E485, 0080E4DF, 0080E52E, 0080E5C0, 0080E615, 0080E654, 0080E6A9, 0080E717, 0080E923, 0080E95C, 0080E990, 0080E9DA, 0080EA14, 0080EA82
1.2.840.113549.1.9.1, xrefs: 0080E7B7, 0080EB22
CryptMsgGetParam 7 fail, xrefs: 0080E98B
CryptMsgOpenToDecode fail, xrefs: 0080E91E
CryptMsgGetParam 6 fail, xrefs: 0080E6A4
1.3.6.1.4.1.311.2.4.1, xrefs: 0080E858
CryptMsgGetParam 8 fail, xrefs: 0080E9D5
CertOpenStore fail, xrefs: 0080EA0F
CryptMsgGetParam 5 fail, xrefs: 0080E64F
CertFindCertificateInStore 2 fail, xrefs: 0080EA7D
CryptMsgGetParam 2 fail, xrefs: 0080E529

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$Crypt$Param$ObjectQuery
String ID: 1.2.840.113549.1.9.1$1.3.6.1.4.1.311.2.4.1$CertFindCertificateInStore 1 fail$CertFindCertificateInStore 2 fail$CertOpenStore fail$CryptMsgGetParam 1 fail$CryptMsgGetParam 2 fail$CryptMsgGetParam 3 fail$CryptMsgGetParam 4 fail$CryptMsgGetParam 5 fail$CryptMsgGetParam 6 fail$CryptMsgGetParam 7 fail$CryptMsgGetParam 8 fail$CryptMsgOpenToDecode fail$CryptQueryObject fail$GetSignaturesInfo
API String ID: 2905775066-2327634912
Opcode ID: cf919d9984a563bd06070490a3498df089df736e07ef6513d23983ff75390918
Instruction ID: f30c40c5762d9ad9e2f8efdf8631136b16af2e6c336e71f33b5db1ad09e88dd4
Opcode Fuzzy Hash: cf919d9984a563bd06070490a3498df089df736e07ef6513d23983ff75390918
Instruction Fuzzy Hash: 9E423E71A041099FDB54EFA9CC45BAFB7B9FF48304F10886AF605F7286DA35A940CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0097D888, Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 225COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0097D894
OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 0097D89A
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0097D8B2
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000001,?,00000000,00000028,?), ref: 0097D8E9
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,00000028,?), ref: 0097D8F4
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,00000028,?), ref: 0097D916
GetLastError.KERNEL32(00000000,00000000,00000028,?), ref: 0097D934
LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 0097D959
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000001,?,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097D990
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097D99B
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097D9BD
GetLastError.KERNEL32(00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097D9DB
LookupPrivilegeValueW.ADVAPI32(00000000,SeImpersonatePrivilege,?), ref: 0097DA00
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000001,?,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000), ref: 0097DA37
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000), ref: 0097DA42
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000), ref: 0097DA64
GetLastError.KERNEL32(00000000,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097DA82
LookupPrivilegeValueW.ADVAPI32(00000000,SeLoadDriverPrivilege,?), ref: 0097DAA7
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000001,?,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000,00000000), ref: 0097DADE
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000), ref: 0097DAE9
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000), ref: 0097DB0B
GetLastError.KERNEL32(00000000,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000), ref: 0097DB29
CloseHandle.KERNEL32(?,00000000,00000000,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?), ref: 0097DB47
GetLastError.KERNEL32(00000000,00000000,00000028,?), ref: 0097DB50

Strings

AdjustTokenPrivileges 3.2 fail, xrefs: 0097DA6A
AdjustTokenPrivileges 4.2 fail, xrefs: 0097DB11
XSettings.GetDebugPrivilege, xrefs: 0097D8FF, 0097D921, 0097D93F, 0097D9A6, 0097D9C8, 0097D9E6, 0097DA4D, 0097DA6F, 0097DA8D, 0097DAF4, 0097DB16, 0097DB34, 0097DB5B
AdjustTokenPrivileges 2.1 fail, xrefs: 0097D9A1
AdjustTokenPrivileges 4.1 fail, xrefs: 0097DAEF
SeIncreaseQuotaPrivilege, xrefs: 0097D952
AdjustTokenPrivileges 1.2 fail, xrefs: 0097D91C
SeImpersonatePrivilege, xrefs: 0097D9F9
AdjustTokenPrivileges 2.2 fail, xrefs: 0097D9C3
OpenProcessToken fail, xrefs: 0097DB56
LookupPrivilegeValue 4 fail, xrefs: 0097DA88, 0097DB2F
SeDebugPrivilege, xrefs: 0097D8AB
LookupPrivilegeValue fail, xrefs: 0097D93A
SeLoadDriverPrivilege, xrefs: 0097DAA0
AdjustTokenPrivileges 1.1 fail, xrefs: 0097D8FA
AdjustTokenPrivileges 3.1 fail, xrefs: 0097DA48
LookupPrivilegeValue 2 fail, xrefs: 0097D9E1

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$Token$AdjustLookupPrivilegePrivilegesValue$Process$CloseCurrentHandleOpen
String ID: AdjustTokenPrivileges 1.1 fail$AdjustTokenPrivileges 1.2 fail$AdjustTokenPrivileges 2.1 fail$AdjustTokenPrivileges 2.2 fail$AdjustTokenPrivileges 3.1 fail$AdjustTokenPrivileges 3.2 fail$AdjustTokenPrivileges 4.1 fail$AdjustTokenPrivileges 4.2 fail$LookupPrivilegeValue 2 fail$LookupPrivilegeValue 4 fail$LookupPrivilegeValue fail$OpenProcessToken fail$SeDebugPrivilege$SeImpersonatePrivilege$SeIncreaseQuotaPrivilege$SeLoadDriverPrivilege$XSettings.GetDebugPrivilege
API String ID: 1726988503-222983939
Opcode ID: ffb4c7f51c6d958b1924e05d868f8f10ee43b3d78b56361ed7a551e9fe20feb1
Instruction ID: 2c92ae18ce93c77aa583537f7ae2e6435f65f1c5da883f68776054932c41ebcb
Opcode Fuzzy Hash: ffb4c7f51c6d958b1924e05d868f8f10ee43b3d78b56361ed7a551e9fe20feb1
Instruction Fuzzy Hash: 2B814D72A06209ABDB50EB94C942FEE77FCAF48704F108125F609F7682D7B4DE409765

Uniqueness

Uniqueness Score: -1.00%

Function 0040D26C, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041B4CC,?,?,?,0040D5A3,00000000,0040D664,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D681), ref: 0040D289
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040D29A
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041B4CC,?,?,?,0040D5A3,00000000,0040D664,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?), ref: 0040D39A
FindClose.KERNEL32(?,?,?,kernel32.dll,0041B4CC,?,?,?,0040D5A3,00000000,0040D664,?,80000001,Software\Embarcadero\Locales,00000000,000F0019), ref: 0040D3AC
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041B4CC,?,?,?,0040D5A3,00000000,0040D664,?,80000001,Software\Embarcadero\Locales,00000000), ref: 0040D3B8
lstrlenW.KERNEL32(?), ref: 0040D3FD

Strings

kernel32.dll, xrefs: 0040D284
GetLongPathNameW, xrefs: 0040D294
\, xrefs: 0040D3CA

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 756b13ae4fee02d201a8439c90753ffb035d13c6b79523c3a5250e1fc4fe0a5d
Instruction ID: 4efc058cc8e4c4edd0d961332372e71fd637c61b115651c449b834b00421c474
Opcode Fuzzy Hash: 756b13ae4fee02d201a8439c90753ffb035d13c6b79523c3a5250e1fc4fe0a5d
Instruction Fuzzy Hash: FB419F71E006189BCB10EFE4CC85AEEB3B5AF84310F5445BA9905F72C1E77CAE498B49

Uniqueness

Uniqueness Score: -1.00%

Function 005AC374, Relevance: 12.1, APIs: 8, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 005AC382
IsIconic.USER32 ref: 005AC3B0
IsWindowVisible.USER32(?), ref: 005AC3C0
ShowWindow.USER32(?,00000000,?,?,?,000000EC,00000000,?,?,?,005B8D63), ref: 005AC3DD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005AC3F0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005AC401
ShowWindow.USER32(?,00000006,?,000000EC,00000000,?,?,?,000000EC,00000000,?,?,?,005B8D63), ref: 005AC421
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,?,?,000000EC,00000000,?,?,?,005B8D63), ref: 005AC42B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Window$LongShow$IconicVisible
String ID:
API String ID: 3484284227-0
Opcode ID: 9f2dc0b7575858d2cb37cc731e9b46662b7856b11d1f8f8a998059e7f734468f
Instruction ID: 866f6578a483aa6b99b4d62fac8ceda237a43128fef0fadaccf110806b6a60f3
Opcode Fuzzy Hash: 9f2dc0b7575858d2cb37cc731e9b46662b7856b11d1f8f8a998059e7f734468f
Instruction Fuzzy Hash: C711942225E69025DB2276361C12FFF5ED45FD731AF18892AF0D4E5282C22D8A85926E

Uniqueness

Uniqueness Score: -1.00%

Function 006E7360, Relevance: 11.4, Strings: 9, Instructions: 148COMMON

Download Yara Rule

Strings

BugTrAccount, xrefs: 006E74CA
SmtpAccount, xrefs: 006E73E0
3mo, xrefs: 006E7532, 006E7427, 006E746B, 006E742A
HttpAccount, xrefs: 006E7455
HttpServer, xrefs: 006E7431, 006E74A6
SmtpPassword, xrefs: 006E73A2, 006E7407
SmtpServer, xrefs: 006E73BC
BugTrPassword, xrefs: 006E748C, 006E74F1
HttpPassword, xrefs: 006E7417, 006E747C

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: 3mo$BugTrAccount$BugTrPassword$HttpAccount$HttpPassword$HttpServer$SmtpAccount$SmtpPassword$SmtpServer
API String ID: 2826327444-3591264646
Opcode ID: 2e939e6b8c81a95e68bd227d4077590fbd1b7ed051d31ffef7b0e8b26c09ff2a
Instruction ID: 35bcb53e18ca5216ae86701e49ecfb60c7d99d5bd8d2682fd0589e4a8ef5d7a1
Opcode Fuzzy Hash: 2e939e6b8c81a95e68bd227d4077590fbd1b7ed051d31ffef7b0e8b26c09ff2a
Instruction Fuzzy Hash: 8951FD74A0524EEBCF05EBD5C481ADEB7BAEF48304F60416AE510B3281EB34AF45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00975E04, Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 254fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00975E9A
CreateFileW.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,00976240,?,\\.\,00000000,00976178,?,00000000,0097620B), ref: 00975F2B
DeviceIoControl.KERNEL32(000000FF,002D1400,?,0000000C,?,00002710,?,00000000), ref: 00975F9A
CloseHandle.KERNEL32(000000FF), ref: 00976169

Strings

\\.\, xrefs: 00975E9F
%s%s%s, xrefs: 0097614B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceDirectoryFileHandleSystem
String ID: %s%s%s$\\.\
API String ID: 3668988384-3260968656
Opcode ID: 12d327041da459caefaa65f1899cf515dde1adc89539256be1bc695e9f020c37
Instruction ID: 9676437397367c974aae711c6cfd6b2c65b4126268602c1a4599f62be6793734
Opcode Fuzzy Hash: 12d327041da459caefaa65f1899cf515dde1adc89539256be1bc695e9f020c37
Instruction Fuzzy Hash: 07A17071A0461C9EDB21DF65CC41ADEB7B9EF49304F5185FAE40CE3281E774AE848E26

Uniqueness

Uniqueness Score: -1.00%

Function 004D70D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004D716C,?,00000000,?,004D7184,?,004D7A0D,00000000,004D7B18,?,00000000,00000001,?,?,?), ref: 004D70F0
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,004D716C,?,00000000,?,004D7184,?,004D7A0D,00000000), ref: 004D7116

Strings

0NG, xrefs: 004D713D

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorFormatLastMessage
String ID: 0NG
API String ID: 3479602957-1567132218
Opcode ID: 8e4d7ad1ca6e8b07cf1e7efabea8415a7cc82e563861b3f20881f57fc815491b
Instruction ID: 19b8e9c809bc5453fc879374ac8f4eff042c65990220bea010c77ae24cd74a41
Opcode Fuzzy Hash: 8e4d7ad1ca6e8b07cf1e7efabea8415a7cc82e563861b3f20881f57fc815491b
Instruction Fuzzy Hash: 7101AC702483465EE721FF61CC52B9A73A9EB44708F50417BBA14E23C2EAB85D50891D

Uniqueness

Uniqueness Score: -1.00%

Function 00975998, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000064), ref: 009759D2

Strings

d, xrefs: 009759C0

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: NameUser
String ID: d
API String ID: 2645101109-2564639436
Opcode ID: 2982596d80a48d093f4fd65a9a1c16575e9ac9410c2a98f7442c38b01f5292e3
Instruction ID: 883f77b9d03826cb149f6d8b1be46643de20fed154af5591cd6d5ea81baa62be
Opcode Fuzzy Hash: 2982596d80a48d093f4fd65a9a1c16575e9ac9410c2a98f7442c38b01f5292e3
Instruction Fuzzy Hash: 40113731900658DBDB50EBA5CC81BCDB3B9EF84304F51C5F6A409B3291EA34AF898F64

Uniqueness

Uniqueness Score: -1.00%

Function 004200A8, Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,00000000,004201D6,?,00000000,?,00000000), ref: 004200E5
QueryDosDeviceW.KERNEL32(?,?,00000104,00000104,?,00000000,004201D6,?,00000000,?,00000000), ref: 0042010F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: DeviceDriveLogicalQueryStrings
String ID:
API String ID: 3173366581-0
Opcode ID: 36b90b9653775da3753b89cd909d97ddbd89789d6b30713bb979b239eae58e75
Instruction ID: 8fd1af11275bbd8e29ad98815c1e6376a42de26ef14b28611df3f1c4909b8c0d
Opcode Fuzzy Hash: 36b90b9653775da3753b89cd909d97ddbd89789d6b30713bb979b239eae58e75
Instruction Fuzzy Hash: A731A671B002189BDB20DF65DC81A9EB7F8EF48300F9040AAE904E7396E778DE548B58

Uniqueness

Uniqueness Score: -1.00%

Function 004E5858, Relevance: 86.0, APIs: 1, Strings: 48, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(uxtheme.dll,00000000,004E5C1C,?,?,?,0057533D,00000011,00000000,?,?,00579A8D,00579AB6,005746D5,005ADA7B,005ADAA6), ref: 004E589F

Strings

GetThemeSysInt, xrefs: 004E5B25
GetCurrentThemeName, xrefs: 004E5BB5
DrawThemeParentBackground, xrefs: 004E5BD9
GetThemePosition, xrefs: 004E5A29
GetThemeBackgroundRegion, xrefs: 004E5951
GetThemeSysSize, xrefs: 004E5AEF
SetThemeAppProperties, xrefs: 004E5BA3
CloseThemeData, xrefs: 004E58C1
GetThemePropertyOrigin, xrefs: 004E5A83
DrawThemeBackground, xrefs: 004E58D3
SetWindowTheme, xrefs: 004E5A95
IsAppThemed, xrefs: 004E5B49
IsThemePartDefined, xrefs: 004E5999
GetThemeColor, xrefs: 004E59BD
HitTestThemeBackground, xrefs: 004E5963
DrawThemeEdge, xrefs: 004E5975
GetThemeRect, xrefs: 004E5A4D
GetThemeDocumentationProperty, xrefs: 004E5BC7
GetThemeTextMetrics, xrefs: 004E593F
GetThemeFilename, xrefs: 004E5AA7
GetThemeMargins, xrefs: 004E5A5F
uxtheme.dll, xrefs: 004E589A
IsThemeBackgroundPartiallyTransparent, xrefs: 004E59AB
EnableThemeDialogTexture, xrefs: 004E5B6D
GetThemeSysColorBrush, xrefs: 004E5ACB
GetThemeSysColor, xrefs: 004E5AB9
GetThemeSysFont, xrefs: 004E5B01
GetThemeIntList, xrefs: 004E5A71
DrawThemeIcon, xrefs: 004E5987
GetThemeSysBool, xrefs: 004E5ADD
OpenThemeData, xrefs: 004E58AF
GetThemeBackgroundContentRect, xrefs: 004E58F7
GetThemeBool, xrefs: 004E59F3
GetThemeAppProperties, xrefs: 004E5B91
IsThemeActive, xrefs: 004E5B37
GetThemeFont, xrefs: 004E5A3B
EnableTheming, xrefs: 004E5BEB
GetThemeString, xrefs: 004E59E1
GetThemePartSize, xrefs: 004E591B
IsThemeDialogTextureEnabled, xrefs: 004E5B7F
GetThemeInt, xrefs: 004E5A05
GetWindowTheme, xrefs: 004E5B5B
DrawThemeText, xrefs: 004E58E5
GetThemeMetric, xrefs: 004E59CF
GetThemeEnumValue, xrefs: 004E5A17
GetThemeBackgroundExtent, xrefs: 004E5909
GetThemeSysString, xrefs: 004E5B13
GetThemeTextExtent, xrefs: 004E592D

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundExtent$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1029625771-1748089680
Opcode ID: d810a50ab1de2fbae836261d22b67ebab086e99e08db4c96aa930734937afdc7
Instruction ID: 38b5470b544c22c079760dd19877a951437ac11fce8ed1b34664fbb19cc3ad83
Opcode Fuzzy Hash: d810a50ab1de2fbae836261d22b67ebab086e99e08db4c96aa930734937afdc7
Instruction Fuzzy Hash: F0A17470999750EFDB00EFB6ED85E267BB4EB09305710066BB200CF251E6799880DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00970DE0, Relevance: 70.4, APIs: 22, Strings: 18, Instructions: 391networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000003,00000000,009712FC,00000000), ref: 00970E5C
InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00970E82
InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00970E9F
GetLastError.KERNEL32(?,00000000,009712DD,?,?,00000000,00000000,?,?,0096D034,00000000,00000000,?,00000000,0096E798), ref: 00970EC5
InternetSetOptionW.WININET(?,00000002,009D067C,00000004), ref: 00970F34
GetLastError.KERNEL32(0088E452,00001388,00000000,?,00000002,009D067C,00000004,00000000,009712DD,?,?,00000000,00000000,?,?,0096D034), ref: 00970F62
InternetSetOptionW.WININET(?,00000005,009D067C,00000004), ref: 00970F8B
GetLastError.KERNEL32(00000000,00001388,00000000,?,00000005,009D067C,00000004,?,00000002,009D067C,00000004,00000000,009712DD,?,?,00000000), ref: 00970FB9
InternetSetOptionW.WININET(?,00000006,009D067C,00000004), ref: 00970FE2
GetLastError.KERNEL32(?,00001388,00000000,?,00000006,009D067C,00000004,?,00000005,009D067C,00000004,?,00000002,009D067C,00000004,00000000), ref: 00971010
InternetSetOptionW.WININET(00000000,00000049,00000064,00000004), ref: 00971034
GetLastError.KERNEL32(?,00000064,00000000,00000000,009712DD,?,?,00000000,00000000,?,?,0096D034,00000000,00000000,?,00000000), ref: 00971060
InternetSetOptionW.WININET(00000000,0000004A,00000064,00000004), ref: 00971084
GetLastError.KERNEL32(00000000,00000064,00000000,00000000,0000004A,00000064,00000004,00000000,009712DD,?,?,00000000,00000000,?,?,0096D034), ref: 009710B0
InternetConnectW.WININET(?,00000000,00000050,00970816,00000000,00000003,00000000,00000000), ref: 00971154
InternetConnectW.WININET(?,00000000,00000050,00000000,00000000,00000003,00000000,00000000), ref: 0097117E
GetLastError.KERNEL32(00000000,00000000,0000004A,00000064,00000004,00000000,009712DD,?,?,00000000,00000000,?,?,0096D034,00000000,00000000), ref: 009711A4
InternetCloseHandle.WININET(?), ref: 009711C4
InternetQueryOptionW.WININET(00000000,00000032,?,00000008), ref: 00971200
GetLastError.KERNEL32(00000000,00000000,0000004A,00000064,00000004,00000000,009712DD,?,?,00000000,00000000,?,?,0096D034,00000000,00000000), ref: 0097121D
InternetSetOptionW.WININET(00000000,00000032,00000001,00000008), ref: 00971280
GetLastError.KERNEL32(0096D034,00000000,00000032,00000001,00000008,00000000,0000004A,00000064,00000004,00000000,009712DD,?,?,00000000,00000000,?), ref: 0097129D

Strings

InternetQueryOption fail, xrefs: 00971223
InternetSetOption INTERNET_OPTION_MAX_CONNS_PER_1_0_SERVER fail, xrefs: 009710B6
XInternet.ConnectToInternet, xrefs: 00970ED0, 00970F09, 00970F6D, 00970FC4, 0097101B, 0097106B, 009710BB, 009711AF, 00971228, 009712A8
Switch to Timeouts, xrefs: 00970F04
InternetSetOption INTERNET_OPTION_CONNECT_TIMEOUT fail, xrefs: 00970F68
MaxConn=, xrefs: 00971052, 009710A2
d, xrefs: 00970EE4
P, xrefs: 009710E9
InternetConnect fail, xrefs: 009711AA
InternetSetOption INTERNET_OPTION_SEND_TIMEOUT fail, xrefs: 00970FBF
InternetSetOption INTERNET_OPTION_MAX_CONNS_PER_SERVER fail, xrefs: 00971066
InternetSetOption fail, xrefs: 009712A3
Agent=, xrefs: 00970EB7
InternetOpen fail, xrefs: 00970ECB
2, xrefs: 009711EB
TimeOut=, xrefs: 00970F54, 00970FAB, 00971002
Host=, xrefs: 00971196, 0097120F, 0097128F
InternetSetOption INTERNET_OPTION_RECEIVE_TIMEOUT fail, xrefs: 00971016

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Internet$ErrorLast$Option$Open$Connect$CloseHandleQuery
String ID: 2$Agent=$Host=$InternetConnect fail$InternetOpen fail$InternetQueryOption fail$InternetSetOption INTERNET_OPTION_CONNECT_TIMEOUT fail$InternetSetOption INTERNET_OPTION_MAX_CONNS_PER_1_0_SERVER fail$InternetSetOption INTERNET_OPTION_MAX_CONNS_PER_SERVER fail$InternetSetOption INTERNET_OPTION_RECEIVE_TIMEOUT fail$InternetSetOption INTERNET_OPTION_SEND_TIMEOUT fail$InternetSetOption fail$MaxConn=$P$Switch to Timeouts$TimeOut=$XInternet.ConnectToInternet$d
API String ID: 3536917618-925042654
Opcode ID: eaa4599bb59e62f3cf8562fef2e0251b6be3a45a3966d8bc966f30c8514dccd0
Instruction ID: 99431d865055d3b63ce3b157f3440b0ebb24fc3e8e5e2b466a7b7f0404cfe400
Opcode Fuzzy Hash: eaa4599bb59e62f3cf8562fef2e0251b6be3a45a3966d8bc966f30c8514dccd0
Instruction Fuzzy Hash: FAE15C72A04209ABDB10EBA9CD42FAEB7B9AF88704F508026F509FB691C7749D41DB15

Uniqueness

Uniqueness Score: -1.00%

Function 0075541C, Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 445COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3(?,00000000,000000FF,?,?,00000000,007559BA,?,00000000,007559DC), ref: 00755495
sqlite3_step.SQLITE3(00000000,?,00000000,007559DC), ref: 007554CB
sqlite3_column_count.SQLITE3(00000000,?,00000000,007559DC), ref: 00755543
sqlite3_column_name.SQLITE3(00000000,00000000,?,00000000,007559DC), ref: 00755588
sqlite3_column_decltype.SQLITE3(00000000,00000000,?,00000000,007559DC), ref: 007555F1
sqlite3_column_type.SQLITE3(00000000,00000000,?,?,?,00000000,007559DC), ref: 0075560A
sqlite3_column_type.SQLITE3(00000000,00000000,?,00000000,007559DC), ref: 0075575C
sqlite3_column_int.SQLITE3(00000000,00000000,?,?,?,00000000,007559DC), ref: 007557A7
sqlite3_column_int.SQLITE3(00000000,00000000,?,?,?,00000000,007559DC), ref: 007557EF
sqlite3_column_double.SQLITE3(00000000,00000000,?,?,?,00000000,007559DC), ref: 0075583E
sqlite3_step.SQLITE3(00000000,00000001,?,?,00000000,007559DC), ref: 00755981
sqlite3_finalize.SQLITE3(00000000,007559C1), ref: 007559B3

Strings

Error executing SQL, xrefs: 007554A4
FLOAT, xrefs: 0075569F
Could not retrieve data, xrefs: 00755970
e, xrefs: 0075598A
INTEGER, xrefs: 00755635
SQLite is Busy, xrefs: 00755943
BLOB, xrefs: 007556DE
NUMERIC, xrefs: 00755685
BOOLEAN, xrefs: 0075565D
DOUBLE, xrefs: 007556B9
Could not prepare SQL statement, xrefs: 007554BA, 00755955

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: sqlite3_column_intsqlite3_column_typesqlite3_step$sqlite3_column_countsqlite3_column_decltypesqlite3_column_doublesqlite3_column_namesqlite3_finalizesqlite3_prepare
String ID: BLOB$BOOLEAN$Could not prepare SQL statement$Could not retrieve data$DOUBLE$Error executing SQL$FLOAT$INTEGER$NUMERIC$SQLite is Busy$e
API String ID: 2931358236-198153785
Opcode ID: dabc19d9c340ed9907a92b2c50ab89fea8c4759fa3a1c6dcdc8012d9226ab7ea
Instruction ID: 556126de3d30d91021183557a6c7b4eafe5f81af615ccf63207ecfa1b4df2cb2
Opcode Fuzzy Hash: dabc19d9c340ed9907a92b2c50ab89fea8c4759fa3a1c6dcdc8012d9226ab7ea
Instruction Fuzzy Hash: 7D021370E00608DFCB00EFA9D895ADEBBF5BF08315F218069E814AB361D779AD498B55

Uniqueness

Uniqueness Score: -1.00%

Function 00413EFC, Relevance: 35.1, APIs: 1, Strings: 19, Instructions: 132libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(PSAPI.dll,00000000,0041441D,00000000,?,00000000,?,0042042A,00000104,00000000,0042047E,?,000003EE,00000004,00000000,00000000), ref: 00413F10

Strings

GetMappedFileNameA, xrefs: 00414032
PSAPI.dll, xrefs: 00413F0B
EmptyWorkingSet, xrefs: 00413FC6
GetModuleFileNameExW, xrefs: 00413F5A, 00413FA2
GetModuleBaseNameA, xrefs: 00413F6C
EnumProcessModules, xrefs: 00413F36
GetMappedFileNameW, xrefs: 00413FFC, 00414068
EnumDeviceDrivers, xrefs: 0041409E
GetDeviceDriverBaseNameA, xrefs: 00414044
GetModuleFileNameExA, xrefs: 00413F7E
EnumProcesses, xrefs: 00413F24
GetDeviceDriverFileNameW, xrefs: 00414020, 0041408C
InitializeProcessForWsWatch, xrefs: 00413FEA
QueryWorkingSet, xrefs: 00413FD8
GetModuleBaseNameW, xrefs: 00413F48, 00413F90
GetProcessMemoryInfo, xrefs: 004140B0
GetModuleInformation, xrefs: 00413FB4
GetDeviceDriverFileNameA, xrefs: 00414056
GetDeviceDriverBaseNameW, xrefs: 0041400E, 0041407A

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: EmptyWorkingSet$EnumDeviceDrivers$EnumProcessModules$EnumProcesses$GetDeviceDriverBaseNameA$GetDeviceDriverBaseNameW$GetDeviceDriverFileNameA$GetDeviceDriverFileNameW$GetMappedFileNameA$GetMappedFileNameW$GetModuleBaseNameA$GetModuleBaseNameW$GetModuleFileNameExA$GetModuleFileNameExW$GetModuleInformation$GetProcessMemoryInfo$InitializeProcessForWsWatch$PSAPI.dll$QueryWorkingSet
API String ID: 1029625771-2267155864
Opcode ID: a530ea6e94b3c16085efd42a0d8b42a94626c9f014e43292bb35502596d3b58c
Instruction ID: 6bab94adf340669f3d54d4e0de60108b0b1c6faf1fc972d46e91edda4befffbf
Opcode Fuzzy Hash: a530ea6e94b3c16085efd42a0d8b42a94626c9f014e43292bb35502596d3b58c
Instruction Fuzzy Hash: 384102B0AE6211EFDB04EFF5DD86A963BB8AB497003100667B680CF244D6B994D0DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00981008, Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 157filesleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 0098105D
CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00981098
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 009810BD
Sleep.KERNEL32(000007D0,00000000,80000000,00000001,00000000,00000003,00000080), ref: 009810D4
CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000004,00000080,00000000,000007D0,00000000,80000000,00000001,00000000,00000003,00000080), ref: 009810FA
GetLastError.KERNEL32(?,00000000,80000000,00000001,00000000,00000003,00000080,00000000,000007D0,00000000,80000000,00000001,00000000,00000003,00000080), ref: 00981131

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000007D0,00000000,80000000,00000001,00000000,00000003,00000080), ref: 0098111F
WriteFile.KERNEL32(000000FF,009D06B0,00000002,00000080,00000000,00000000,80000000,00000001,00000000,00000003,00000080), ref: 00981167
GetLastError.KERNEL32(?,000000FF,009D06B0,00000002,00000080,00000000,00000000,80000000,00000001,00000000,00000003,00000080), ref: 00981174
SetEndOfFile.KERNEL32(000000FF,000000FF,009D06B0,00000002,00000080,00000000,00000000,80000000,00000001,00000000,00000003,00000080), ref: 00981192
GetLastError.KERNEL32(?,000000FF,000000FF,009D06B0,00000002,00000080,00000000,00000000,80000000,00000001,00000000,00000003,00000080), ref: 0098119F
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,80000000,00000001,00000000,00000003,00000080), ref: 009811C9
GetLastError.KERNEL32(?,000000FF,00000000,00000000,00000002,00000000,80000000,00000001,00000000,00000003,00000080), ref: 009811D7

Strings

CreateFileW fail, xrefs: 00981137
WriteFile fail, xrefs: 0098117A
SetFilePointer fail, xrefs: 009811DD
XFile.AssignFileW, xrefs: 00981068, 0098113C, 0098117F, 009811AA, 009811E2
SetEndOfFile fail, xrefs: 009811A5
DeleteFile fail, xrefs: 00981063

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$ErrorLast$Create$AttributesPointerSleepWrite
String ID: CreateFileW fail$DeleteFile fail$SetEndOfFile fail$SetFilePointer fail$WriteFile fail$XFile.AssignFileW
API String ID: 130721769-3356998030
Opcode ID: 03bf9fcd8f154ee5aa0b288940af8e674d6ace53a69340ac3621ad57c269a452
Instruction ID: 4354d27e97fdb2364ffda9e130217ac5b73e55e40212b9080faabd9acfe8ea2b
Opcode Fuzzy Hash: 03bf9fcd8f154ee5aa0b288940af8e674d6ace53a69340ac3621ad57c269a452
Instruction Fuzzy Hash: 0F519070B04344BAEB20FBE48D46F9E77AC9B04754F104559B211FB3D2C6B8AE82A758

Uniqueness

Uniqueness Score: -1.00%

Function 005D3BA0, Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 119COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000002,005D3F6F,00000000,?,0097D4ED,00000000,0097D6BD,?,00000000,0097D712,?,?,00000000), ref: 005D3BB4

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,00000000), ref: 004120D2

Strings

Heap32Next, xrefs: 005D3C0C
Heap32First, xrefs: 005D3BFA
Toolhelp32ReadProcessMemory, xrefs: 005D3C1E
kernel32.dll, xrefs: 005D3BAF
Module32First, xrefs: 005D3CC0
Process32NextW, xrefs: 005D3C66, 005D3C8A
Process32FirstW, xrefs: 005D3C54, 005D3C78
CreateToolhelp32Snapshot, xrefs: 005D3BC4
Heap32ListFirst, xrefs: 005D3BD6
Heap32ListNext, xrefs: 005D3BE8
Process32First, xrefs: 005D3C30
Module32Next, xrefs: 005D3CD2
Thread32First, xrefs: 005D3C9C
Process32Next, xrefs: 005D3C42
Module32NextW, xrefs: 005D3CF6, 005D3D1A
Thread32Next, xrefs: 005D3CAE
Module32FirstW, xrefs: 005D3CE4, 005D3D08

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: d5f0d03f6633a1fa61bec0b7eda62ab8285d19158d6d68961c494af58b882053
Instruction ID: 08e7478eeef35f781aa046ff012645f950cf88b1e3b170deebe397da4ea8646e
Opcode Fuzzy Hash: d5f0d03f6633a1fa61bec0b7eda62ab8285d19158d6d68961c494af58b882053
Instruction Fuzzy Hash: 364121B0999211EFCB20ABFDDD85A657FB8F7097047000667B500CF395E6B98980DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0083616C, Relevance: 28.8, APIs: 1, Strings: 18, Instructions: 306COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00836589,?,?,?,?,00000000,00000000,?,00836A23,?,0088E437,00000000,00836C36), ref: 008361FB

Part of subcall function 00424AF0: GetLocalTime.KERNEL32(?), ref: 00424AF8

Strings

Recently checked. Skip: , xrefs: 008362AC
Fail get info about update, xrefs: 0083632E
Ini.UpdateFile: , xrefs: 00836519
.json, xrefs: 008362E4
Up-to-date, xrefs: 00836481
TryOpenIniFile failed, xrefs: 00836201
Driver Updater NextGen (compatible; Indy Library), xrefs: 0083631C
Old database: checking, xrefs: 008361A8
Found new: , xrefs: 008364CD
Date not found, xrefs: 008363BD
LastUpdate broken, xrefs: 00836419
-> , xrefs: 008364D5
Empty LoadInternetPage result, xrefs: 0083635C
IsThereBaseUpdate, xrefs: 008361AD, 00836206, 008362B9, 00836333, 00836361, 008363C2, 0083641E, 00836486, 008364ED, 0083653A
date, xrefs: 0083638F
general, xrefs: 0083624E, 00836462
settings.ini, xrefs: 008361C7, 008361ED, 00836525
LastUpdate, xrefs: 00836249, 0083645D

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLastLocalTime
String ID: -> $.json$Date not found$Driver Updater NextGen (compatible; Indy Library)$Empty LoadInternetPage result$Fail get info about update$Found new: $Ini.UpdateFile: $IsThereBaseUpdate$LastUpdate$LastUpdate broken$Old database: checking$Recently checked. Skip: $TryOpenIniFile failed$Up-to-date$date$general$settings.ini
API String ID: 982271005-664479170
Opcode ID: 97eeee8cfd3266916f796d92d35fd5168564ccc9a4d682b8628d1076acbf386e
Instruction ID: 6bc4eb194d65b8d438a5ea886c782626e4c5d260bb0621aac412f00a28188a2a
Opcode Fuzzy Hash: 97eeee8cfd3266916f796d92d35fd5168564ccc9a4d682b8628d1076acbf386e
Instruction Fuzzy Hash: 14B17030A00109AFCB00EB98D842AADB7B5FFC9704F508479F510EB3D5EA79AC65CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004D7188, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004D719F
CreateCompatibleDC.GDI32(00000000), ref: 004D71A9
GetObjectW.GDI32(?,00000018,?,00000000,004D72D6,?,00000000,?,00000000,?), ref: 004D71C9
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004D71E0
GetDC.USER32(00000000), ref: 004D71EC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004D7219
ReleaseDC.USER32 ref: 004D723F
SelectObject.GDI32(?,?), ref: 004D725A
SelectObject.GDI32(004D7B18,00000000), ref: 004D7269
StretchBlt.GDI32(004D7B18,00000000,00000000,?,?,?,00000000,00000000,+zM,00000000,00CC0020), ref: 004D7295
SelectObject.GDI32(?,00000000), ref: 004D72A3
SelectObject.GDI32(004D7B18,00000000), ref: 004D72B1
DeleteDC.GDI32(?), ref: 004D72C7
DeleteDC.GDI32(004D7B18), ref: 004D72D0

Strings

+zM, xrefs: 004D7279, 004D727C

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID: +zM
API String ID: 644427674-384097346
Opcode ID: 09ac206a4650dba55787f4f00aaa5369b2c34cafb47220b19aa08299cc27581b
Instruction ID: 362b9227d6746599a0d996e44097d3bed8953fb8371634dde1c46d9c109a3d26
Opcode Fuzzy Hash: 09ac206a4650dba55787f4f00aaa5369b2c34cafb47220b19aa08299cc27581b
Instruction Fuzzy Hash: B1412B71E44248AFDB51EBE9CD52FEFB7BCEB08704F504456B600E7281E6B899408B68

Uniqueness

Uniqueness Score: -1.00%

Function 0054E1D4, Relevance: 25.0, APIs: 11, Strings: 3, Instructions: 469windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005B01A8: GetWindowLongW.USER32(00000000,000000F0), ref: 005B0219
Part of subcall function 005B01A8: GetWindowLongW.USER32(00000000,000000EC), ref: 005B022B
Part of subcall function 005B01A8: GetClassLongW.USER32(00000000,000000E6), ref: 005B023E
Part of subcall function 005B01A8: SetWindowLongW.USER32(00000000,000000F0), ref: 005B027E
Part of subcall function 005B01A8: SetWindowLongW.USER32(00000000,000000EC,?), ref: 005B0292
Part of subcall function 005B01A8: SetClassLongW.USER32(00000000,000000E6,?), ref: 005B02A6
Part of subcall function 005B01A8: SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 005B02E0

Part of subcall function 0054D9A4: GetTextExtentPointW.GDI32(00000000,00000034,00000034,00000000), ref: 0054D9E5

MulDiv.KERNEL32(00000008,00000000,00000004), ref: 0054E2A2
MulDiv.KERNEL32(00000008,00000000,00000008), ref: 0054E2B2
MulDiv.KERNEL32(0000000A,00000000,00000004), ref: 0054E2BF
MulDiv.KERNEL32(0000000A,00000000,00000008), ref: 0054E2CF
MulDiv.KERNEL32(00000032,00000000,00000004), ref: 0054E2DC
DrawTextW.USER32(00000000,00000000,000000FF,?,00000000), ref: 0054E353
MulDiv.KERNEL32(0000000E,00000000,00000008), ref: 0054E38D
MulDiv.KERNEL32(00000004,00000000,00000004), ref: 0054E39D
SetRect.USER32 ref: 0054E3C3
DrawTextW.USER32(00000000,00000000,?,?,00000000), ref: 0054E405
LoadIconW.USER32(00000000,00000000), ref: 0054E568

Strings

Image, xrefs: 0054E54B
Message, xrefs: 0054E5B4
, xrefs: 0054E437

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Long$Window$Text$ClassDraw$ExtentIconLoadMessagePointRectSend
String ID: $Image$Message
API String ID: 2658010395-721294388
Opcode ID: 673e3953df4c67592e0d3662a679a90c13f9769db4d2a3cbf9055b5a69731c33
Instruction ID: 9b461b4d6657d88189d469d66e7a6a366cc6fc7674469bc46c70aec61ceb7373
Opcode Fuzzy Hash: 673e3953df4c67592e0d3662a679a90c13f9769db4d2a3cbf9055b5a69731c33
Instruction Fuzzy Hash: AF124874E002099FDB10DFA8C986AEDBBF6BF49308F144169E904EB392DB74AD45CB15

Uniqueness

Uniqueness Score: -1.00%

Function 006E6FF4, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 134filememorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E6F28: GetCurrentProcessId.KERNEL32(?,00000000,006E6FAE,?,00000000), ref: 006E6F54
Part of subcall function 006E6F28: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,?,00000000,006E6FAE,?,00000000), ref: 006E6F8E

Part of subcall function 006E2774: GetModuleHandleA.KERNEL32(advapi32.dll,SetEntriesInAclA), ref: 006E279F
Part of subcall function 006E2774: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E2809
Part of subcall function 006E2774: InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000000,advapi32.dll,SetEntriesInAclA), ref: 006E28C8

GetCurrentProcessId.KERNEL32(?,00000000,006E7186,?,00000000,006E71A8,?,?,00400000,00000000), ref: 006E704F
OpenFileMappingA.KERNEL32 ref: 006E707D
GetCurrentProcessId.KERNEL32(?,00000006,00000000,00000000,?,00000000,006E7186,?,00000000,006E71A8,?,?,00400000,00000000), ref: 006E7091
CreateFileMappingA.KERNEL32 ref: 006E70C7
MessageBoxA.USER32 ref: 006E70E2
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,00000006,00000000,00000000,?,00000000,006E7186,?,00000000,006E71A8), ref: 006E70F9
VirtualAlloc.KERNEL32(00000000,00000028,00001000,00000004,00000000,000F001F,00000000,00000000,00000000,00000006,00000000,00000000,?,00000000,006E7186), ref: 006E710B
InitializeCriticalSection.KERNEL32(-00000008,00000000,00000028,00001000,00000004,00000000,000F001F,00000000,00000000,00000000,00000006,00000000,00000000,?,00000000,006E7186), ref: 006E7129
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,00000006,00000000,00000000,?,00000000,006E7186,?,00000000,006E71A8), ref: 006E713C
CloseHandle.KERNEL32(00000000,00000000,000F001F,00000000,00000000,00000000,00000006,00000000,00000000,?,00000000,006E7186,?,00000000,006E71A8), ref: 006E7144

Strings

madExcept, xrefs: 006E70D6
Vvn, xrefs: 006E70A5, 006E70B2
internal error (opening settings buffer), xrefs: 006E70DB
madExceptSettingsBuf2, xrefs: 006E7066, 006E70A8

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentFileProcess$HandleInitializeMappingView$AllocCloseCreateCriticalDescriptorMessageModuleObjectOpenSectionSecuritySingleVirtualWait
String ID: Vvn$internal error (opening settings buffer)$madExcept$madExceptSettingsBuf2
API String ID: 2700174819-1992250719
Opcode ID: 17221033e79eec68fda7aa849bfd94485a965299f31c0bc78767182db436b0d0
Instruction ID: c072aaae84cd74b0798ea58b059da7605204f821539ab6bb7bff9691d873a52d
Opcode Fuzzy Hash: 17221033e79eec68fda7aa849bfd94485a965299f31c0bc78767182db436b0d0
Instruction Fuzzy Hash: 4C41F630A453487FE710EB66DC42FEE7BB6EB48B54F144029F600BB2D1DBB858458759

Uniqueness

Uniqueness Score: -1.00%

Function 0084A498, Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 162COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0084A4B4
GetTickCount.KERNEL32 ref: 0084A4EA

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

Strings

Drivers_new.db, xrefs: 0084A507
Scan just started, xrefs: 0084A4D1
InitAndScanResultFrame, xrefs: 0084A4D6, 0084A5CF
Unfortunately, your computer does not have enough available disk space to complete this operation. Please free up some disk space, xrefs: 0084A609
Glo-11-update-noinet, xrefs: 0084A676
10-update-noinet, xrefs: 0084A657
Updating, xrefs: 0084A5CA
FailSpace, xrefs: 0084A619
Engine, xrefs: 0084A61E
11-update-noinet, xrefs: 0084A680
Glo-10-update-noinet, xrefs: 0084A64D

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CountTick$AttributesFile
String ID: 10-update-noinet$11-update-noinet$Drivers_new.db$Engine$FailSpace$Glo-10-update-noinet$Glo-11-update-noinet$InitAndScanResultFrame$Scan just started$Unfortunately, your computer does not have enough available disk space to complete this operation. Please free up some disk space$Updating
API String ID: 3143076460-4035462752
Opcode ID: 1168e2babf9020ac5102db4c83410a8c9d3d0a6aefa7f3a58281c0c8efab1ccc
Instruction ID: 5869aae7b061ac4260c67e644a4a9308b2b0b7655bd67ba3d9bc7c9790a9feb8
Opcode Fuzzy Hash: 1168e2babf9020ac5102db4c83410a8c9d3d0a6aefa7f3a58281c0c8efab1ccc
Instruction Fuzzy Hash: 0951A0346992089FD708EF58C981BA937F5FB4A304F514066F600DF3A2CA39ED449B13

Uniqueness

Uniqueness Score: -1.00%

Function 00979D78, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 108filesleepCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00979DB3
Sleep.KERNEL32(000001F4), ref: 00979DD0
MoveFileW.KERNEL32(00000000,00000000), ref: 00979DE7
Sleep.KERNEL32(00000BB8,00000000,00000000,000001F4), ref: 00979E04
MoveFileW.KERNEL32(00000000,00000000), ref: 00979E1B
GetLastError.KERNEL32(00979F70,?, -> ,?,Cannot rename: ,00000000,00000000,00000BB8,00000000,00000000,000001F4), ref: 00979E60

Part of subcall function 004266E0: FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,0042B39A,?,00429642,00000000,004296A3,?,?), ref: 00426704
Part of subcall function 004266E0: LocalFree.KERNEL32(?,0042675D,00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,0042B39A,?,00429642,00000000,004296A3), ref: 00426750

GetLastError.KERNEL32(00000BB8,?, -> ,?,00000000,00000000,00000BB8,00000000,00000000,000001F4), ref: 00979EAF

Strings

-> , xrefs: 00979E53, 00979E96
.safetodelete, xrefs: 00979E38
TryRenameFile, xrefs: 00979E82, 00979EBA
Cannot rename: , xrefs: 00979E4B
Cannot rename, xrefs: 00979EB5

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileMove$ErrorLastSleep$FormatFreeLocalMessage
String ID: -> $.safetodelete$Cannot rename$Cannot rename: $TryRenameFile
API String ID: 257129892-1007475475
Opcode ID: e56bd4d10d3e05853910fbb5435c46707c9a1b31b7ba674fa68ff4a5758ae148
Instruction ID: 0156030441ecd0105e093ec9554dbe781ce8827b4ac36f8d3b120f1d77c12fa4
Opcode Fuzzy Hash: e56bd4d10d3e05853910fbb5435c46707c9a1b31b7ba674fa68ff4a5758ae148
Instruction Fuzzy Hash: 7B41A771E04249BFDF01EBA9C902B9EBBF8DF45308F4084AAF004F2691C6789E55D719

Uniqueness

Uniqueness Score: -1.00%

Function 0083691C, Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 218COMMON

Download Yara Rule

Strings

No database: Update requires , xrefs: 00836A6C
UpdateDriverBases: Already updating, xrefs: 00836956
.prev, xrefs: 00836B44, 00836B65, 00836B93, 00836BB2
Drivers_new.db, xrefs: 008369C8
18-update-noneed, xrefs: 00836A99
DeleteFile fail, xrefs: 00836B7C
UpdateDriverBases, xrefs: 00836A51, 00836A79, 00836AD3, 00836B81, 00836BCE
TryRenameFile fail, xrefs: 00836BC9
19-update-noneed, xrefs: 00836ABB
There is new database: , xrefs: 00836A44
Update requires, xrefs: 00836ACE

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID:
String ID: .prev$18-update-noneed$19-update-noneed$DeleteFile fail$Drivers_new.db$No database: Update requires $There is new database: $TryRenameFile fail$Update requires$UpdateDriverBases$UpdateDriverBases: Already updating
API String ID: 0-3310818445
Opcode ID: cff755a4026532b22770c75401d6287c8ac37276f37def2a3f0a58b4a55ee29a
Instruction ID: ca75ea13efc267ecf7aef47ae4caa604fb2795a3ab7c6315d58f2b4185079dab
Opcode Fuzzy Hash: cff755a4026532b22770c75401d6287c8ac37276f37def2a3f0a58b4a55ee29a
Instruction Fuzzy Hash: 54819130A04148BFCB11EBA8D841B9DBBB5FF85304F10C066E540EB391E7759D5ADB95

Uniqueness

Uniqueness Score: -1.00%

Function 0098E3E0, Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,0000020A), ref: 0098E513
GetWindowsDirectoryW.KERNEL32(?,0000020A,?,0000020A,00000000,0098E78F,?,?,00000000,00000000,?,?,007B4F01,?,00000000,007B505F), ref: 0098E55B
QueryDosDeviceW.KERNEL32(00000000,?,00000104,?,0000020A,?,0000020A,00000000,0098E78F,?,?,00000000,00000000,?,?,007B4F01), ref: 0098E5EA
GetLastError.KERNEL32(00000000,00000000,?,00000104,?,0000020A,?,0000020A,00000000,0098E78F,?,?,00000000,00000000,?), ref: 0098E685

Strings

SOFTWARE\PC HelpSoft Driver Updater, xrefs: 0098E6BB
NewDB, xrefs: 0098E6D0, 0098E6E1
mm-dd-yyyy, xrefs: 0098E4F2
OldDB, xrefs: 0098E70C, 0098E71D
InitParams, xrefs: 0098E690
QueryDosDevice fail, xrefs: 0098E68B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Directory$DeviceErrorLastQuerySystemWindows
String ID: InitParams$NewDB$OldDB$QueryDosDevice fail$SOFTWARE\PC HelpSoft Driver Updater$mm-dd-yyyy
API String ID: 2226724641-3255885571
Opcode ID: a8b0e67d0e9fff3b67075cbaca2f64c7d4406e1fd36828f2a878ac15649a3273
Instruction ID: a9057dfb9e13149ae0d44a61b00be343ad5337c88945e9ac3f88ed80a0355383
Opcode Fuzzy Hash: a8b0e67d0e9fff3b67075cbaca2f64c7d4406e1fd36828f2a878ac15649a3273
Instruction Fuzzy Hash: 61A1BF34A45209DFCB10FB55CC91A9D77BAEF45304F5080ABE404AB3A2DB38AE81DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00426F10, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004089E4: GetTickCount.KERNEL32 ref: 00408A1B
Part of subcall function 004089E4: GetTickCount.KERNEL32 ref: 00408A33

Part of subcall function 00426764: GetLocaleInfoW.KERNEL32(00000800,0000100B,?,00000100,00000000,00000800,?,00426F8C,?,?), ref: 00426782

GetThreadLocale.KERNEL32(00000000,00000004,?,?), ref: 00426FA8
EnumCalendarInfoW.KERNEL32(00426DD4,00000000,00000000,00000004,?,?), ref: 00426FB3
GetThreadLocale.KERNEL32(00000000,00000003,00426DD4,00000000,00000000,00000004,?,?), ref: 00426FEE
EnumCalendarInfoW.KERNEL32(00426E78,00000000,00000000,00000003,00426DD4,00000000,00000000,00000004,?,?), ref: 00426FF9
GetThreadLocale.KERNEL32(00000000,00000004,?,?), ref: 0042708A
EnumCalendarInfoW.KERNEL32(00426DD4,00000000,00000000,00000004,?,?), ref: 00427095
GetThreadLocale.KERNEL32(00000000,00000003,00426DD4,00000000,00000000,00000004,?,?), ref: 004270D2
EnumCalendarInfoW.KERNEL32(00426E78,00000000,00000000,00000003,00426DD4,00000000,00000000,00000004,?,?), ref: 004270DD

Strings

B.C., xrefs: 00427038
4mB, xrefs: 00426F69, 00427025, 0042715C

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: 4mB$B.C.
API String ID: 1601775584-4233717565
Opcode ID: 0be2d50cc1044f06f269234f8dc4a8e57e51c5d45517d0f50eed8a9806bff9a5
Instruction ID: ed240e7f5eee31eb1f9972e048f2cdef6f8592694a11badd04e42f1a8c88c9dc
Opcode Fuzzy Hash: 0be2d50cc1044f06f269234f8dc4a8e57e51c5d45517d0f50eed8a9806bff9a5
Instruction Fuzzy Hash: 55612775B052159FD710EF69EC81A6A37A5FB08314F51413BE948E73A1C778DC81CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 005D1584, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 168libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,005D17B6), ref: 005D1634
GetLastError.KERNEL32(00000000,00000000,005D17B6), ref: 005D16AE
GetLastError.KERNEL32(00000000,00000000,005D17B6), ref: 005D16BA
GetLastError.KERNEL32(00000000,00000000,005D17B6), ref: 005D16FB
GetLastError.KERNEL32(00000000,00000000,005D17B6), ref: 005D1707

Part of subcall function 004266E0: FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,0042B39A,?,00429642,00000000,004296A3,?,?), ref: 00426704
Part of subcall function 004266E0: LocalFree.KERNEL32(?,0042675D,00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,0042B39A,?,00429642,00000000,004296A3), ref: 00426750

FreeLibrary.KERNEL32(00000000,00000000,CreateObject,00000000,00000000,005D17B6), ref: 005D1763

Strings

Error loading library %s %d %s, xrefs: 005D1726
CreateObject, xrefs: 005D173C
Library not found %s %d %s, xrefs: 005D16D9
%s is not a 7z library, xrefs: 005D1778

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLibrary$FormatLoadLocalMessage
String ID: %s is not a 7z library$CreateObject$Error loading library %s %d %s$Library not found %s %d %s
API String ID: 580709419-3365780041
Opcode ID: 262b9002088f368c5693edf7d5296a64730ff21a7a0371bae46d2b23883eac92
Instruction ID: cab80f57db70c6f1f85ba4adbc82e016c1c22b957677c792b53b19dfdf140254
Opcode Fuzzy Hash: 262b9002088f368c5693edf7d5296a64730ff21a7a0371bae46d2b23883eac92
Instruction Fuzzy Hash: BB712874E00249EFCB10EFA9D981ADDBBF0BF08304F50816AE514A7352DBB9AD45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00872B94, Relevance: 16.7, APIs: 1, Strings: 10, Instructions: 196COMMON

Download Yara Rule

Strings

SearchDrivers, xrefs: 00872C4F, 00872CF9
TfrmSubResultMain.Callback: incorrect Status, xrefs: 00872DE7
Error or process interrupted by user!, xrefs: 00872D45
SubStatusPreparing, xrefs: 00872C2C
Message4, xrefs: 00872D55
Update, xrefs: 00872D5A
Subscription, xrefs: 00872C54, 00872CFE
Preparing, xrefs: 00872C1C
Engine, xrefs: 00872C31
Searching for drivers, xrefs: 00872C3F, 00872CE9

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID:
String ID: Engine$Error or process interrupted by user!$Message4$Preparing$SearchDrivers$Searching for drivers$SubStatusPreparing$Subscription$TfrmSubResultMain.Callback: incorrect Status$Update
API String ID: 0-2867102575
Opcode ID: a3c6dbcb2112444cd4411fac189191c0220f91767099453af85f744f26e051e5
Instruction ID: 8bd58507d0e841634fbffe9a530ae7a90090d9105c6f747e0bd106083add83ce
Opcode Fuzzy Hash: a3c6dbcb2112444cd4411fac189191c0220f91767099453af85f744f26e051e5
Instruction Fuzzy Hash: 08810335659248AFC710EF58D881FA97BF5FB49300F1080A6EA19DB3A6C730ED81EB15

Uniqueness

Uniqueness Score: -1.00%

Function 004267DC, Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000800,00000001,00000000,00426AC1,?,?,?,?,00000000,00000000,?,0096B384,00000000,0096B409), ref: 00426803
GetThreadLocale.KERNEL32(00000800,00000001,00000000,00426AC1,?,?,?,?,00000000,00000000,?,0096B384,00000000,0096B409), ref: 0042680C

Part of subcall function 004267B0: GetLocaleInfoW.KERNEL32(00000800,0000000F,?,00000002,0000002C,?,00000800,?,004268B2,?,?,?,00000800,00000001,00000000,00426AC1), ref: 004267C3

Part of subcall function 00426764: GetLocaleInfoW.KERNEL32(00000800,0000100B,?,00000100,00000000,00000800,?,00426F8C,?,?), ref: 00426782

Strings

:mm, xrefs: 00426A59
mmmm d, yyyy, xrefs: 00426932
m/d/yy, xrefs: 0042690D
AMPM, xrefs: 00426A3A
2, xrefs: 00426A9D
:mm:ss, xrefs: 00426A74
AMPM , xrefs: 00426A49

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 8b7f43aa2ac6a498dc7f39b83abe41c83c955505888d53dfbc59e2360b5c04c2
Instruction ID: 92a47355705cf3aa801e65b701f140256c591ebe3771733004902ee924e10342
Opcode Fuzzy Hash: 8b7f43aa2ac6a498dc7f39b83abe41c83c955505888d53dfbc59e2360b5c04c2
Instruction Fuzzy Hash: 2D7181347001689BDB01EB65E891A9E76AAEF84708F91C07BF500EB34ADB3DDD06875D

Uniqueness

Uniqueness Score: -1.00%

Function 006E2774, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,SetEntriesInAclA), ref: 006E279F

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E2809

Part of subcall function 006E26F4: OpenProcessToken.ADVAPI32(00000000,00000008,?,00000000,?,?), ref: 006E270A
Part of subcall function 006E26F4: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,00000000,00000008,?,00000000,?,?), ref: 006E2726
Part of subcall function 006E26F4: LocalAlloc.KERNEL32(00000040,?,?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008,?,00000000,?,?), ref: 006E2733
Part of subcall function 006E26F4: GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,?,?,00000040,?,?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008,?,00000000), ref: 006E274D
Part of subcall function 006E26F4: CloseHandle.KERNEL32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000040,?,?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008), ref: 006E2766

InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000000,advapi32.dll,SetEntriesInAclA), ref: 006E28C8
SetSecurityDescriptorDacl.ADVAPI32(?,000000FF,00000000,00000000,?,00000001,00000000,advapi32.dll,SetEntriesInAclA), ref: 006E28D7
FreeSid.ADVAPI32(00000000,?,000000FF,00000000,00000000,?,00000001,00000000,advapi32.dll,SetEntriesInAclA), ref: 006E28E6
FreeSid.ADVAPI32(00000000,?,000000FF,00000000,00000000,?,00000001,00000000,advapi32.dll), ref: 006E28F7
LocalFree.KERNEL32(00000000,?,000000FF,00000000,00000000,?,00000001), ref: 006E2908

Part of subcall function 00411B84: AllocateAndInitializeSid.ADVAPI32(009BC880,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,006E27D5,00000000,00000000), ref: 00411BAB

Strings

SetEntriesInAclA, xrefs: 006E2795
advapi32.dll, xrefs: 006E279A

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FreeToken$DescriptorHandleInformationInitializeLocalProcessSecurity$AddressAllocAllocateCloseCurrentDaclModuleOpenProc
String ID: SetEntriesInAclA$advapi32.dll
API String ID: 435592921-2764761592
Opcode ID: 78952b9072e92582498837119d2dc859fecc40461131060b9f94fedeca42eeca
Instruction ID: 80124a88cc1c3b45b67267160adc23db5d5e5323925c62e92e48455e305c4e16
Opcode Fuzzy Hash: 78952b9072e92582498837119d2dc859fecc40461131060b9f94fedeca42eeca
Instruction Fuzzy Hash: 704171702093019FD710DF2AC845B9BB7E9AF88714F008A2EF698D7391E7B9D844CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00981314, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 009813BA
GetLastError.KERNEL32(Text,00000000,00000000,00000000,?,00000000), ref: 009813CE
WriteFile.KERNEL32(00000000,009D06B2,00000002,?,00000000,00000000,00000000,00000000,?,00000000), ref: 009813F9
GetLastError.KERNEL32(Eof,00000000,009D06B2,00000002,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0098140D

Strings

XFile.WriteLnW, xrefs: 00981359, 009813D9, 00981418
Eof, xrefs: 00981408
WriteFile fail, xrefs: 009813D4, 00981413
Invalid handle, xrefs: 00981354
Text, xrefs: 009813C9

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: Eof$Invalid handle$Text$WriteFile fail$XFile.WriteLnW
API String ID: 442123175-1343911282
Opcode ID: 0c8344a38ac3638ab957628264bf9218a6afdccd894759aabd4cc2ee106b93c5
Instruction ID: a44add6d6751e14cb05ce37e87c8c8167f21cfea4fbfbb761e84a0584c5751df
Opcode Fuzzy Hash: 0c8344a38ac3638ab957628264bf9218a6afdccd894759aabd4cc2ee106b93c5
Instruction Fuzzy Hash: 32314F70A00309AFDB10FBA5C942BAEB7BDAB44708F50456AA100E77A2D6789A42C755

Uniqueness

Uniqueness Score: -1.00%

Function 0040D128, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(009D4B8C,00000000,0040D22C,?,?,?,00000000,?,0040DAF4,00000000,0040DB53,?,?,00000000,00000000,00000000), ref: 0040D146
LeaveCriticalSection.KERNEL32(009D4B8C,009D4B8C,00000000,0040D22C,?,?,?,00000000,?,0040DAF4,00000000,0040DB53,?,?,00000000,00000000), ref: 0040D16A
LeaveCriticalSection.KERNEL32(009D4B8C,009D4B8C,00000000,0040D22C,?,?,?,00000000,?,0040DAF4,00000000,0040DB53,?,?,00000000,00000000), ref: 0040D179
IsValidLocale.KERNEL32(00000000,00000002,009D4B8C,009D4B8C,00000000,0040D22C,?,?,?,00000000,?,0040DAF4,00000000,0040DB53), ref: 0040D18B
EnterCriticalSection.KERNEL32(009D4B8C,00000000,00000002,009D4B8C,009D4B8C,00000000,0040D22C,?,?,?,00000000,?,0040DAF4,00000000,0040DB53), ref: 0040D1E8
LeaveCriticalSection.KERNEL32(009D4B8C,009D4B8C,00000000,00000002,009D4B8C,009D4B8C,00000000,0040D22C,?,?,?,00000000,?,0040DAF4,00000000,0040DB53), ref: 0040D211

Strings

en-US,en,, xrefs: 0040D156, 0040D1FD

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-US,en,
API String ID: 975949045-3579323720
Opcode ID: 560bb046f36da0f7c271db05c8cf947cf74bbb7f7621dc38df197a9bcdc6128c
Instruction ID: a3e236101a6ef0417b13906e48cd9e9b2a5d99d4b8d538a458ff0f97516a28aa
Opcode Fuzzy Hash: 560bb046f36da0f7c271db05c8cf947cf74bbb7f7621dc38df197a9bcdc6128c
Instruction Fuzzy Hash: EC219DB0B902006BE710BBE6CC0372E2299ABC5709F51443BB100B77D2CABDCD4592AF

Uniqueness

Uniqueness Score: -1.00%

Function 0097CFA0, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 0097CFE3
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 0097CFE9
GetTokenInformation.ADVAPI32(?,00000014(TokenIntegrityLevel),0088E452,00000004,00000000,00000000,00000008,?), ref: 0097D002
CloseHandle.KERNEL32(?,00000000,00000000,?,TokenIntegrityLevel,0088E452,00000004,00000000,00000000,00000008,?), ref: 0097D035

Strings

XSystem.IsElevated, xrefs: 0097D022, 0097D049
OpenProcessToken fail, xrefs: 0097D044
GetTokenInformation fail, xrefs: 0097D01D

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID: GetTokenInformation fail$OpenProcessToken fail$XSystem.IsElevated
API String ID: 215268677-449742295
Opcode ID: 8b0415c62d30de70f767ddc7433b6fe0521d27a8aea9f91ab4fa2dee906c47d2
Instruction ID: 8adeade47b944e3b94cb1902417e93f83b790cef0e37f1348197d983ed48a6f0
Opcode Fuzzy Hash: 8b0415c62d30de70f767ddc7433b6fe0521d27a8aea9f91ab4fa2dee906c47d2
Instruction Fuzzy Hash: 47110B3154D284AADB10E7A59C01BED3BBD4F06304F00915ABA48D73D2D67EC986D32B

Uniqueness

Uniqueness Score: -1.00%

Function 00506614, Relevance: 15.2, APIs: 10, Instructions: 203COMMON

Download Yara Rule

APIs

SaveDC.GDI32(?), ref: 00506632

Part of subcall function 004FE080: GetWindowOrgEx.GDI32(?), ref: 004FE08E
Part of subcall function 004FE080: SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 004FE0A4

IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 0050666B
GetWindowLongW.USER32(00000000,000000EC), ref: 0050667F
GetWindowLongW.USER32(00000000,000000F0), ref: 005066A0
SetRect.USER32 ref: 0050670A
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 0050676E

Part of subcall function 00506558: SaveDC.GDI32(?), ref: 00506569
Part of subcall function 00506558: ExcludeClipRect.GDI32(?,?,?,?,?,00000000,005065F6,?,?,00000000), ref: 005065AA
Part of subcall function 00506558: RestoreDC.GDI32(?,?), ref: 005065F0

SetRect.USER32 ref: 0050678F
DrawEdge.USER32(?,?,00000000,00000000), ref: 0050679E
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 005067C7
RestoreDC.GDI32(?,?), ref: 00506846

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Rect$ClipWindow$Intersect$LongRestoreSave$DrawEdgeExclude
String ID:
API String ID: 3997055466-0
Opcode ID: 496c84cb6f33f30399105156df713fdcced328d61a3cc9f1ddce3df73ac398ab
Instruction ID: b305a1ed2a2542e412c6cd267cf26a291a5cd2e341e7880e1b9dfc064cea8f18
Opcode Fuzzy Hash: 496c84cb6f33f30399105156df713fdcced328d61a3cc9f1ddce3df73ac398ab
Instruction Fuzzy Hash: ED71F875A00209AFDB10EB98C985FAEBBF9FF48304F104195B904EB292CB75EE51DB54

Uniqueness

Uniqueness Score: -1.00%

Function 005B01A8, Relevance: 15.1, APIs: 10, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 005B0219
GetWindowLongW.USER32(00000000,000000EC), ref: 005B022B
GetClassLongW.USER32(00000000,000000E6), ref: 005B023E
SetWindowLongW.USER32(00000000,000000F0), ref: 005B027E
SetWindowLongW.USER32(00000000,000000EC,?), ref: 005B0292
SetClassLongW.USER32(00000000,000000E6,?), ref: 005B02A6
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 005B02E0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 005B02F8
GetSystemMenu.USER32(00000000,000000FF,00000000,000000EC,?,?,00000000,000000EC,00000000,000000F0), ref: 005B0307
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037,00000000,000000EC,?,?,00000000,000000EC,00000000,000000F0), ref: 005B0330

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Long$Window$ClassMessageSend$MenuSystem
String ID:
API String ID: 494549727-0
Opcode ID: 3b8618677096611df9eebee6e96ca697de7c578194dd7274ff683feb854f87e5
Instruction ID: 99e98a5fddd75b1b189dd9ae562d6f819cfd40e134ab87e5ec21012834bc5fa5
Opcode Fuzzy Hash: 3b8618677096611df9eebee6e96ca697de7c578194dd7274ff683feb854f87e5
Instruction Fuzzy Hash: BA41C430308A4126D616B7398D4EFFF6A9A3FC1314F1C4A19B4949B2D2CF78AC46D355

Uniqueness

Uniqueness Score: -1.00%

Function 0097BA98, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 151sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

GetLastError.KERNEL32 ref: 0097BAE2
Sleep.KERNEL32(000003E8), ref: 0097BB02
Sleep.KERNEL32(000003E8,000003E8), ref: 0097BB1C
GetTickCount.KERNEL32 ref: 0097BB29

Part of subcall function 004222A8: GetFileAttributesW.KERNEL32(00000000), ref: 004222E7
Part of subcall function 004222A8: SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00422343
Part of subcall function 004222A8: GetLastError.KERNEL32(00000000,00000080), ref: 0042234C

Sleep.KERNEL32(000003E8), ref: 0097BBC0
Sleep.KERNEL32(000003E8,000003E8), ref: 0097BC16
GetTickCount.KERNEL32 ref: 0097BC2E

Part of subcall function 004224B8: DeleteFileW.KERNEL32(00000000,?,?,?,00000000,0097BADA), ref: 004224C8
Part of subcall function 004224B8: GetLastError.KERNEL32(00000000,?,?,?,00000000,0097BADA), ref: 004224D7
Part of subcall function 004224B8: GetFileAttributesW.KERNEL32(00000000,00000000,?,?,?,00000000,0097BADA), ref: 004224DF
Part of subcall function 004224B8: RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,?,00000000,0097BADA), ref: 004224FA

Strings

.safetodelete, xrefs: 0097BB3D, 0097BC42

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$AttributesSleep$ErrorLast$CountTick$DeleteDirectoryRemove
String ID: .safetodelete
API String ID: 3105682181-2421937573
Opcode ID: 3c3d65c9a2e6e37e6eb87d6cccbfb1c33b65737c731028623dac10d4bfabd4f3
Instruction ID: 8cdf5dd69e5ce1bc1e31963d4d1ce7c930a3c40b12d0fce0e18391c1b2e06ab9
Opcode Fuzzy Hash: 3c3d65c9a2e6e37e6eb87d6cccbfb1c33b65737c731028623dac10d4bfabd4f3
Instruction Fuzzy Hash: 7D41A831A00244AFDF02EBA9D982FAD77B9EF9470CF40C46AF94467292CB795D05C624

Uniqueness

Uniqueness Score: -1.00%

Function 0096C41C, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(schannel.dll), ref: 0096C43B
LoadLibraryW.KERNEL32(wininet.dll,schannel.dll), ref: 0096C448

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,00000000), ref: 004120D2

FreeLibrary.KERNEL32(00000000,0096C4D4,SslEmptyCacheW,00000000,0096C4CD,?,wininet.dll,schannel.dll), ref: 0096C4BE
FreeLibrary.KERNEL32(00000000,00000000,0096C4D4,SslEmptyCacheW,00000000,0096C4CD,?,wininet.dll,schannel.dll), ref: 0096C4C7

Strings

IncrementUrlCacheHeaderData, xrefs: 0096C47B
schannel.dll, xrefs: 0096C436
wininet.dll, xrefs: 0096C443
SslEmptyCacheW, xrefs: 0096C46A

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: IncrementUrlCacheHeaderData$SslEmptyCacheW$schannel.dll$wininet.dll
API String ID: 145871493-2818637324
Opcode ID: 72168fad4395daf59360579195e673564839b681c8e47476b3cfa72d3bd8b701
Instruction ID: 640daa688c3643293dcf540995fdd82c143ff737daa42c236a1bcddc0f96867c
Opcode Fuzzy Hash: 72168fad4395daf59360579195e673564839b681c8e47476b3cfa72d3bd8b701
Instruction Fuzzy Hash: E51151B0E84348AFDB10EBE4DC16BBDBBB8EB84708F004496B540A6191DBB85A90DB55

Uniqueness

Uniqueness Score: -1.00%

Function 004D724C, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(?,?), ref: 004D725A
SelectObject.GDI32(004D7B18,00000000), ref: 004D7269
StretchBlt.GDI32(004D7B18,00000000,00000000,?,?,?,00000000,00000000,+zM,00000000,00CC0020), ref: 004D7295
SelectObject.GDI32(?,00000000), ref: 004D72A3
SelectObject.GDI32(004D7B18,00000000), ref: 004D72B1
DeleteDC.GDI32(?), ref: 004D72C7
DeleteDC.GDI32(004D7B18), ref: 004D72D0

Strings

+zM, xrefs: 004D7279, 004D727C

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID: +zM
API String ID: 1458357782-384097346
Opcode ID: 53500466cd5a589c8d4f1b173e70cd4a3b3ea79131decde610f93350cde95db6
Instruction ID: 99d34d593d3ddbfdc86570c46ce97332ea2ee22d9269e715451a56fe5363577e
Opcode Fuzzy Hash: 53500466cd5a589c8d4f1b173e70cd4a3b3ea79131decde610f93350cde95db6
Instruction Fuzzy Hash: 6D11DB72E44259AFDB10EAE9CD96FEFB3FCEB08700F104556B610E7281D6B8AC418764

Uniqueness

Uniqueness Score: -1.00%

Function 004E84C0, Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ole32.dll), ref: 004E84D6

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,00000000), ref: 004120D2

Strings

CoResumeClassObjects, xrefs: 004E8521
CoInitializeEx, xrefs: 004E84F1
CoSuspendClassObjects, xrefs: 004E8531
ole32.dll, xrefs: 004E84D1
CoReleaseServerProcess, xrefs: 004E8511
CoAddRefServerProcess, xrefs: 004E8501
CoCreateInstanceEx, xrefs: 004E84E1

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: f73f0bf70d30c0f3dd2dde1ba2d34170f489652092964cf47bbb15160c1b128b
Instruction ID: 08d12d39588457b2bbcbd27473bf739725b40a687dfef4e9f46795d0a68607b2
Opcode Fuzzy Hash: f73f0bf70d30c0f3dd2dde1ba2d34170f489652092964cf47bbb15160c1b128b
Instruction Fuzzy Hash: 59F0C2B0994382FED7006B335E83A633F689684719310075FB74596153EEFD4960DB1C

Uniqueness

Uniqueness Score: -1.00%

Function 006E69C0, Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E68BC: FindResourceA.KERNEL32(00400000,TMADEXCEPT,0000000A), ref: 006E68C4

LoadResource.KERNEL32(00400000,00000000,00000000,006E6D7E,?,00000000,00400000,00400000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E6A26
LockResource.KERNEL32(00000000,00400000,00000000,00000000,006E6D7E,?,00000000,00400000,00400000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E6A34
LocalAlloc.KERNEL32(00000040,?,?,00000000,00400000,00400000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,006E7396,00000000), ref: 006E6A93
MessageBoxA.USER32 ref: 006E6D43

Strings

madExcept, xrefs: 006E6D05
3mo, xrefs: 006E6D60, 006E6D0F, 006E6D23, 006E6D12
Internal error: Invalid settings resource (, xrefs: 006E6D0A

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Resource$AllocFindLoadLocalLockMessage
String ID: 3mo$Internal error: Invalid settings resource ($madExcept
API String ID: 2403918263-1565066357
Opcode ID: a7dd01869f952f166ffb25607cf31880f15ab2747c10659775bdafc31e75aaff
Instruction ID: 46d5e4780d91de3322c287daf0585cf9d261624745ec5a85a8df60d3391802be
Opcode Fuzzy Hash: a7dd01869f952f166ffb25607cf31880f15ab2747c10659775bdafc31e75aaff
Instruction Fuzzy Hash: 5EB1ADB0B40359ABEB10DBA6CC82FAEB7B9EF55704F104065B500FB2D5D6B4AE01CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0097E19C, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 256COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,00000000), ref: 0097E261
GetLastError.KERNEL32(?,00000004,00000000,00000104,00000000), ref: 0097E291
QueryDosDeviceW.KERNEL32(00000000,?,00000104,00000104,00000000), ref: 0097E3C2
GetLastError.KERNEL32(?,00000000,?,00000104,00000104,00000000), ref: 0097E496

Strings

QueryDosDevice fail, xrefs: 0097E49C
XFile.LogicalDriveStringsInit, xrefs: 0097E29C, 0097E4A1
GetLogicalDriveStrings fail, xrefs: 0097E297

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$DeviceDriveLogicalQueryStrings
String ID: GetLogicalDriveStrings fail$QueryDosDevice fail$XFile.LogicalDriveStringsInit
API String ID: 163669979-2562431215
Opcode ID: 511fcf4d85730e27b51793260e73f62ed6623340067aafe71ffbdf3f97a9f901
Instruction ID: 062f0d73521c114e78743eaeff9f091cedba13a618ef7cf475a08c0ca1a7e560
Opcode Fuzzy Hash: 511fcf4d85730e27b51793260e73f62ed6623340067aafe71ffbdf3f97a9f901
Instruction Fuzzy Hash: 0BA19471A04219DFCB10EBA9D985A9DB7F9FB88304F5085BBE004F7291D738AE41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00984114, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 178threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042B320: LCMapStringW.KERNEL32(00000409,01000100,00000000,?,00000000,?), ref: 0042B38C

GetCurrentThreadId.KERNEL32 ref: 009841E3
Beep.KERNEL32 ref: 0098421C
MessageBoxW.USER32(00000000,00000000,00000000,009843BC), ref: 0098424B

Strings

Item state:, xrefs: 009842BC
%userpath%, xrefs: 009841B2
========================================, xrefs: 009842DE
Error on Terminate, xrefs: 00984223

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: BeepCurrentMessageStringThread
String ID: %userpath%$========================================$Error on Terminate$Item state:
API String ID: 3435699583-622638177
Opcode ID: 3afd13cd193b483b28dd68bbf6eac2d9546e1f07de86b0d38290fd08b2d79454
Instruction ID: 15c9df1fab472006864801d1d7fc9e8e95f776ec8884b1bc7993cefd80e05db6
Opcode Fuzzy Hash: 3afd13cd193b483b28dd68bbf6eac2d9546e1f07de86b0d38290fd08b2d79454
Instruction Fuzzy Hash: 9A618370A04209AFDF01EBA4D941BDDBBB5EF85308F50406AF800B73A1DB74AD55DB55

Uniqueness

Uniqueness Score: -1.00%

Function 0042FACC, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0042FB65
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0042FB81
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0042FBBA
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0042FC37
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0042FC50
VariantCopy.OLEAUT32(?,00738649), ref: 0042FC85

Strings

, xrefs: 0042FAE6

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 5d2fa8337990a499f3b0d19623b44ae5b3461a81d5ac9623ff275b169bc94dd4
Instruction ID: 2811e01d5ff23d0f31ec4b46202e076eeb1997cfc20f929238b8eb7247280145
Opcode Fuzzy Hash: 5d2fa8337990a499f3b0d19623b44ae5b3461a81d5ac9623ff275b169bc94dd4
Instruction Fuzzy Hash: C4511275A0062D9BCB21DF59DC90AD9B3BCAF49304F8041FAF508D7211D674AF858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00988944, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

Part of subcall function 00424AF0: GetLocalTime.KERNEL32(?), ref: 00424AF8

IsCharAlphaNumericW.USER32(?,?,?,00000000,00988AE9), ref: 009889F6

Strings

CreateDebugBackup, xrefs: 00988A6A, 00988A9A
c:\debug.pc, xrefs: 00988979
.zip, xrefs: 00988A39
BaseDir not exists, xrefs: 00988A95
Save backup to , xrefs: 00988A4B
Debug_, xrefs: 00988A29

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AlphaAttributesCharFileLocalNumericTime
String ID: .zip$BaseDir not exists$CreateDebugBackup$Debug_$Save backup to $c:\debug.pc
API String ID: 4242976036-2916529132
Opcode ID: 1b0ff6a8f1a1509aed01ca5dba72b28cc354e7f851cee15e453f952a8b071eb2
Instruction ID: 7ad61ddbbf622640b8d2f4f49a8e408ea2fcb1f43afc0373137341f225d5685a
Opcode Fuzzy Hash: 1b0ff6a8f1a1509aed01ca5dba72b28cc354e7f851cee15e453f952a8b071eb2
Instruction Fuzzy Hash: 63513D70A00209EFDF14EF99D941AAEB7F5FF88304F904466E400A73A1EB75AD41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0097EA98, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Psapi.dll,00000000,0097EBAC), ref: 0097EAC8
GetLastError.KERNEL32(00000000), ref: 0097EB62

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Strings

GetProcessImageFileName, xrefs: 0097EB4F, 0097EB6D
Invalid result, xrefs: 0097EB4A
Psapi.dll, xrefs: 0097EAC3
GetProcessImageFileName fail, xrefs: 0097EB68
GetProcessImageFileNameA, xrefs: 0097EAD6

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryLoadProc
String ID: GetProcessImageFileName$GetProcessImageFileName fail$GetProcessImageFileNameA$Invalid result$Psapi.dll
API String ID: 3511525774-2512495157
Opcode ID: f2cb9e166bef28889c6049470c62cce93f157c2a306f7e045c7db60bc16ed471
Instruction ID: 29a7a20e3cd4bd3761453f2a00e86aca5a76b4302041786d384e1d5ba983d340
Opcode Fuzzy Hash: f2cb9e166bef28889c6049470c62cce93f157c2a306f7e045c7db60bc16ed471
Instruction Fuzzy Hash: 73316D72A042089FCB14EBA6CC42B9E7BB4EB88704F5085BAF005F76E1D6789D40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 007566D4, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Setupapi.dll), ref: 007566F1

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

GetLastError.KERNEL32 ref: 0075674A

Strings

SetupDiGetDeviceProperty not exists, xrefs: 00756786
Setupapi.dll, xrefs: 007566EC
SetupDiGetDevicePropertyW, xrefs: 007566FF
SetupDiGetDevicePropertyVar fail, xrefs: 00756767
SetupDiGetDeviceProperty, xrefs: 0075676C, 0075678B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryLoadProc
String ID: SetupDiGetDeviceProperty$SetupDiGetDeviceProperty not exists$SetupDiGetDevicePropertyVar fail$SetupDiGetDevicePropertyW$Setupapi.dll
API String ID: 3511525774-3638961544
Opcode ID: 3b5455255e10b5799bad3abb0602153dc1dd10f6637533609fa1b454ea55b584
Instruction ID: ac875c116a709666fdf0ad2eebfcb06f6c0d0521ec67c0eef15ee2765eb163c5
Opcode Fuzzy Hash: 3b5455255e10b5799bad3abb0602153dc1dd10f6637533609fa1b454ea55b584
Instruction Fuzzy Hash: 6D2141B0901209DFCB14DFA8C945BEF77F4EB0C315F504525BA14E7250D7B8AA84DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00755274, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3(10896459,00000000,000000FF,?,?,00000000,0075531B), ref: 007552A8
sqlite3_step.SQLITE3(00000000,?,?,00000000,0075531B), ref: 007552DE
sqlite3_finalize.SQLITE3(00000000,00755322,0075531B), ref: 00755314

Part of subcall function 007550D8: sqlite3_errcode.SQLITE3(?,00000000,007551F9,?,00000000), ref: 0075511A
Part of subcall function 007550D8: sqlite3_errmsg.SQLITE3(?,00000000,007551F9,?,00000000), ref: 0075512B

Strings

Error executing SQL, xrefs: 007552B7
e, xrefs: 007552E7
Could not prepare SQL statement, xrefs: 007552CD
Error executing SQL statement, xrefs: 007552F0

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: sqlite3_errcodesqlite3_errmsgsqlite3_finalizesqlite3_preparesqlite3_step
String ID: Could not prepare SQL statement$Error executing SQL$Error executing SQL statement$e
API String ID: 3909180211-3975281705
Opcode ID: 2905a94396ef827c9b520f2546be5d8c7ae247f44aed0988c05062efb9a606a4
Instruction ID: 2109cf429b8c22ce6462e1c2a19fceb6da7acbd03b26c3142d94b38ed46e55e2
Opcode Fuzzy Hash: 2905a94396ef827c9b520f2546be5d8c7ae247f44aed0988c05062efb9a606a4
Instruction Fuzzy Hash: 921121B1D00648EFCB14DBA8C8659DDB7B8EB44316F2144A5F814A7691D7B89E48CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00970CC4, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 00970CE5
InternetCloseHandle.WININET(?), ref: 00970CF8
InternetCloseHandle.WININET(?), ref: 00970D0B
InternetSetOptionW.WININET(00000000,00000032,00000010,00000008), ref: 00970D39
GetLastError.KERNEL32(00000000,00000000,00000032,00000010,00000008), ref: 00970D44

Strings

XInternet.CloseInternet, xrefs: 00970D4F
InternetSetOption fail, xrefs: 00970D4A

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$ErrorLastOption
String ID: InternetSetOption fail$XInternet.CloseInternet
API String ID: 1599100076-2523073928
Opcode ID: d5ebcaad8dd38c72b0d0829652b018c9d651e3d6be7c38b8f25f1ae8083ebaab
Instruction ID: bc2f531274560f8b0a0170776caa896baa8c2b89dacd059c5f4594a93e3a1a65
Opcode Fuzzy Hash: d5ebcaad8dd38c72b0d0829652b018c9d651e3d6be7c38b8f25f1ae8083ebaab
Instruction Fuzzy Hash: DC11FE71D05348EFDB25EBD8C445B9D7BF8AF85300F0481A5A548EB2D1DB74AE80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00405A3C, Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 00405AD2
Sleep.KERNEL32(0000000A,00000000,?), ref: 00405AEC

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 556c7593de29e5785ab1930b5cbaae6f0e9230b0411fbc403caf9e1beab242fa
Instruction ID: 755dde84a76cf6b80065cd7e932eb4e8b1b6085b539a69eca1b8a9c51cb625a5
Opcode Fuzzy Hash: 556c7593de29e5785ab1930b5cbaae6f0e9230b0411fbc403caf9e1beab242fa
Instruction Fuzzy Hash: 0B710131645A008BE715DF29CD84B17BBE0EB95314F1882BFE448AB3D2D6789841CF99

Uniqueness

Uniqueness Score: -1.00%

Function 007A24BC, Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00420C44: CharLowerBuffW.USER32(00000000,?,00000000,?,?,00428E85,00000000,00428EB7,?,?,?,00000000,00000000,00000000,00000000), ref: 00420C77

GetLastError.KERNEL32 ref: 007A25A2
GetLastError.KERNEL32(?,?,, Devn=,?,InstanceID=), ref: 007A2706

Strings

, Devn=, xrefs: 007A25BB, 007A2612, 007A26D4
SetupDiGetDeviceInstanceId fail, xrefs: 007A270C
SetupDiEnumDeviceInfo fail, xrefs: 007A2648
FindDevice, xrefs: 007A25F6, 007A264D, 007A2711
InstanceID=, xrefs: 007A25B3, 007A260A, 007A26CC
Not found, xrefs: 007A25F1

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$BuffCharLower
String ID: , Devn=$FindDevice$InstanceID=$Not found$SetupDiEnumDeviceInfo fail$SetupDiGetDeviceInstanceId fail
API String ID: 3309958224-1895657389
Opcode ID: 78a1743fdb0d6137a631060b586c0710a008b81751e10181383e6cddbd2c7ec9
Instruction ID: 11cef67f6a09ca94bf75262d8560322adb9de70bdcfb3b5e49659fb3eb7010ed
Opcode Fuzzy Hash: 78a1743fdb0d6137a631060b586c0710a008b81751e10181383e6cddbd2c7ec9
Instruction Fuzzy Hash: DF713B74A0025A9FCB11DF59C881ADDB7F4EF49304F4041BAF508E7692C778AE829F55

Uniqueness

Uniqueness Score: -1.00%

Function 005BA854, Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 005BA8D9
SetForegroundWindow.USER32(00000000), ref: 005BA918

Part of subcall function 005AC374: GetWindowLongW.USER32(?,000000EC), ref: 005AC382
Part of subcall function 005AC374: IsIconic.USER32 ref: 005AC3B0
Part of subcall function 005AC374: IsWindowVisible.USER32(?), ref: 005AC3C0
Part of subcall function 005AC374: ShowWindow.USER32(?,00000000,?,?,?,000000EC,00000000,?,?,?,005B8D63), ref: 005AC3DD
Part of subcall function 005AC374: SetWindowLongW.USER32(?,000000EC,00000000), ref: 005AC3F0
Part of subcall function 005AC374: ShowWindow.USER32(?,00000006,?,000000EC,00000000,?,?,?,000000EC,00000000,?,?,?,005B8D63), ref: 005AC421

Part of subcall function 005AC374: SetWindowLongW.USER32(?,000000EC,00000000), ref: 005AC401
Part of subcall function 005AC374: ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,?,?,000000EC,00000000,?,?,?,005B8D63), ref: 005AC42B

GetWindowLongW.USER32(?,000000EC), ref: 005BA93B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005BA94F
SetWindowTextW.USER32(?,00000000), ref: 005BA95D
GetWindowLongW.USER32(?,000000EC), ref: 005BA96D
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005BA981
SetWindowTextW.USER32(?,00000000), ref: 005BA9A1

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Window$Long$Show$ForegroundText$IconicVisible
String ID:
API String ID: 982591973-0
Opcode ID: 8a8990d4cee66fb4578815bff581870dd751b8287bb1fccfda8df24e6a39ab4d
Instruction ID: 5875d0f64c23090c701e6321641cce5348c71a177f8cc745ddcebcf90043e807
Opcode Fuzzy Hash: 8a8990d4cee66fb4578815bff581870dd751b8287bb1fccfda8df24e6a39ab4d
Instruction Fuzzy Hash: 8C318331204B8067D720EB39C885BEB7BE46F82314F188A1DF4D69B296CE64FD81A755

Uniqueness

Uniqueness Score: -1.00%

Function 005B87A0, Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 005B87C6
IsWindowUnicode.USER32(00000000), ref: 005B8809
SendMessageW.USER32(00000000,?,?,?), ref: 005B8824
SendMessageA.USER32(00000000,?,?,?), ref: 005B8843
GetWindowThreadProcessId.USER32(00000000), ref: 005B8852
GetWindowThreadProcessId.USER32(?,?), ref: 005B8863
SendMessageW.USER32(00000000,?,?,?), ref: 005B8883

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: MessageSendWindow$ProcessThread$CaptureUnicode
String ID:
API String ID: 1994056952-0
Opcode ID: 7640bbf62f6ca5324804f5ce73eefb5afe8a8fb0addf8715ddb62ebe44df59f8
Instruction ID: 026ea2f7c2517ccf57c1a42cb4c9f15a8352615ae4a245c4e13a9dac1d945647
Opcode Fuzzy Hash: 7640bbf62f6ca5324804f5ce73eefb5afe8a8fb0addf8715ddb62ebe44df59f8
Instruction Fuzzy Hash: FF2186712046086F9660EA5ACE80EFB7BDCFB14314F585829FA59C3202EF64FC50C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405C34, Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65184fcdb1ca4699e3c22ab1f347da626d962c82d9d785b10dc3d596e39f171
Instruction ID: 76d2352387d66775406b64483f37e4e0a2622e2bc73d969f15559b2f0ba15d81
Opcode Fuzzy Hash: a65184fcdb1ca4699e3c22ab1f347da626d962c82d9d785b10dc3d596e39f171
Instruction Fuzzy Hash: 3EC1F362710A040BE714AA6DDD8836F7386DBC4325F58863FE144EB3D5DA7CCD428B98

Uniqueness

Uniqueness Score: -1.00%

Function 004D7CFC, Relevance: 10.7, APIs: 7, Instructions: 182windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000018,?,?), ref: 004D7E1B
GetObjectW.GDI32(?,00000018,?,?,00000018,?,?), ref: 004D7E2A
GetBitmapBits.GDI32(?,?,?), ref: 004D7E7B
GetBitmapBits.GDI32(?,?,?), ref: 004D7E89
DeleteObject.GDI32(?), ref: 004D7E92
DeleteObject.GDI32(?), ref: 004D7E9B
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 004D7EBF

Part of subcall function 004D70D0: GetLastError.KERNEL32(00000000,004D716C,?,00000000,?,004D7184,?,004D7A0D,00000000,004D7B18,?,00000000,00000001,?,?,?), ref: 004D70F0
Part of subcall function 004D70D0: FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,004D716C,?,00000000,?,004D7184,?,004D7A0D,00000000), ref: 004D7116

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Object$BitmapBitsDelete$CreateErrorFormatIconLastMessage
String ID:
API String ID: 187626170-0
Opcode ID: cb4126639e442dc95816d41bc80de14550ba2d44172bfde9f73bc3a8669fdc81
Instruction ID: 3f1da93803465ee4af009b9dd49277d769f40aa157b35dfc0c9dab37187dad0b
Opcode Fuzzy Hash: cb4126639e442dc95816d41bc80de14550ba2d44172bfde9f73bc3a8669fdc81
Instruction Fuzzy Hash: 66710271A00219AFCB00DFA9C891AEEBBF9FF09314B118456F844EB351E638ED51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0098233C, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 173windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000B6,00000000,-00000001), ref: 00982541
SendMessageW.USER32(00000000,000000B6,00000000,-00000001), ref: 0098257F
SetForegroundWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,000000B6), ref: 009825A7

Strings

.log, xrefs: 009823A7, 00982462, 009824B5
program, xrefs: 0098238A
_prev.log, xrefs: 009823DE, 00982415

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: MessageSend$ForegroundWindow
String ID: .log$_prev.log$program
API String ID: 3090259878-3040537216
Opcode ID: 18959c22552765e09cda30fe56e1dbbcaafbf28bf9b62440a5fe8b141e3750a2
Instruction ID: 576988930c269ed723759e828f34ef724ab77f812637618327828503904ed927
Opcode Fuzzy Hash: 18959c22552765e09cda30fe56e1dbbcaafbf28bf9b62440a5fe8b141e3750a2
Instruction Fuzzy Hash: AB714774650205EFDB10EBA8D999E9E77B5FF48314F1040A6F800AB3A2CB79AD81DB11

Uniqueness

Uniqueness Score: -1.00%

Function 004089E4, Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408E44: GetCurrentThreadId.KERNEL32 ref: 00408E47

GetTickCount.KERNEL32 ref: 00408A1B
GetTickCount.KERNEL32 ref: 00408A33
GetCurrentThreadId.KERNEL32 ref: 00408A63
GetTickCount.KERNEL32 ref: 00408A8E
GetTickCount.KERNEL32 ref: 00408AC5
GetTickCount.KERNEL32 ref: 00408AEF
GetCurrentThreadId.KERNEL32 ref: 00408B5F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 1e8b057112bbee59774cb28fae24b3c8587b4d752d9c1b92979146866bea60ea
Instruction ID: 5244fc18e72cd994ea5b5365150bf1f8ae95a1f28890d8ce06c8abe1cda5d64c
Opcode Fuzzy Hash: 1e8b057112bbee59774cb28fae24b3c8587b4d752d9c1b92979146866bea60ea
Instruction Fuzzy Hash: 414191B06083415ED721AE78CA8431FBBE1AB90354F15893FE4D8976C1DF7CD881875A

Uniqueness

Uniqueness Score: -1.00%

Function 005B8A04, Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 005B8A18
IsWindowUnicode.USER32 ref: 005B8A2C
PeekMessageW.USER32 ref: 005B8A4F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 005B8A65
TranslateMessage.USER32 ref: 005B8AEA
DispatchMessageW.USER32 ref: 005B8AF7
DispatchMessageA.USER32 ref: 005B8AFF

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
String ID:
API String ID: 2190272339-0
Opcode ID: 4bb061371b7c6acb0d0e9008ae318a7e20725419563478212389dcd863148321
Instruction ID: decec49cc97efa940d33e6adce3cc13e2bb23d5a82b75881188bcd2728087748
Opcode Fuzzy Hash: 4bb061371b7c6acb0d0e9008ae318a7e20725419563478212389dcd863148321
Instruction Fuzzy Hash: 5321293034434426EA3165394D02BFEAF8EBFD2B48F28555EF581D71C2CEE9B846C216

Uniqueness

Uniqueness Score: -1.00%

Function 00754E20, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_open.SQLITE3(00000000,?,00000000,00754F3B,?,00000000,00754F58,?,?,?,?,?,?,00835C98,00000000,00835CA5), ref: 00754E8E
sqlite3_errmsg.SQLITE3(00000000,?,?,?,?,?,?,00835C98,00000000,00835CA5,?,00000000,00835F0B), ref: 00754EAF
sqlite3_free.SQLITE3(00000000,00754F42,?,?,?,00835C98,00000000,00835CA5,?,00000000,00835F0B,?,?,?,?,00000005), ref: 00754F34

Strings

Failed to open database "%s" : %s, xrefs: 00754ED2
PRAGMA SYNCHRONOUS=NORMAL;, xrefs: 00754F10
Failed to open database "%s" : unknown error, xrefs: 00754EFA

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: sqlite3_errmsgsqlite3_freesqlite3_open
String ID: Failed to open database "%s" : %s$Failed to open database "%s" : unknown error$PRAGMA SYNCHRONOUS=NORMAL;
API String ID: 3879141266-1595458244
Opcode ID: ee5c9ceb7c029d56efc80fac8aaa7c298760334c0c4d191cd4c3687340fefe12
Instruction ID: 648453eaccc22a3ae290e9f613f8a53e46239dbcc36743c7902e980d3e855d2b
Opcode Fuzzy Hash: ee5c9ceb7c029d56efc80fac8aaa7c298760334c0c4d191cd4c3687340fefe12
Instruction Fuzzy Hash: 43316D70D04208DFDB01DFA8D856ADEBBF5EB08309F1544A9F900B7291D7B95E88CB59

Uniqueness

Uniqueness Score: -1.00%

Function 007B4910, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

RtlGetNtVersionNumbers.NTDLL ref: 007B495D

Strings

, dwMinorVersion=, xrefs: 007B499F
, dwBuildNumber=, xrefs: 007B49B6
Wrong result, xrefs: 007B49E0
InitVersions, xrefs: 007B49E5
dwMajorVersion=, xrefs: 007B4988

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: NumbersVersion
String ID: , dwBuildNumber=$, dwMinorVersion=$InitVersions$Wrong result$dwMajorVersion=
API String ID: 1687081227-2554124559
Opcode ID: 4fee8e4db5ed00b3a4ad7d55fe8e494daa7ccca36f393cfc50172694a4b8b184
Instruction ID: cf8766cbbfcd3855ca5da7c4ce8dce7fde9a7adb44ed006ab97fe1f63a28418e
Opcode Fuzzy Hash: 4fee8e4db5ed00b3a4ad7d55fe8e494daa7ccca36f393cfc50172694a4b8b184
Instruction Fuzzy Hash: 53318DB1A44209AFDB01DBA5CC41FEFB7BDEB88700F518076F500E2692DA38AD00DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00987DAC, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 00987DF8
GetLastError.KERNEL32(00000000,0000011C), ref: 00987E03

Strings

GetVersionEx fail, xrefs: 00987E09
IsSupportedOS, xrefs: 00987E0E, 00987E59, 00987E86
wProductType=, xrefs: 00987E49
XP or Vista, xrefs: 00987E81

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLastVersion
String ID: GetVersionEx fail$IsSupportedOS$XP or Vista$wProductType=
API String ID: 305913169-3271633791
Opcode ID: bb09d4afb09f8994d7eddc14564d2255591513e80b5e935a3b6eb4f591d8690b
Instruction ID: 3d585bf2c7fe163654a05e8cb3fe53f83f1c8047995fdbe489661b2cb3a3e737
Opcode Fuzzy Hash: bb09d4afb09f8994d7eddc14564d2255591513e80b5e935a3b6eb4f591d8690b
Instruction Fuzzy Hash: A021C170A0C2885FDB21EBA5C8017EDBBE59B89304F6040E9E444A7793DB78DE95CB15

Uniqueness

Uniqueness Score: -1.00%

Function 0097DFC8, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll), ref: 0097DFEE
GetLastError.KERNEL32(00000000), ref: 0097E033

Strings

XProcess.IsWow64Process, xrefs: 0097E03E
kernel32.dll, xrefs: 0097DFE9
IsWow64Process fail, xrefs: 0097E039
IsWow64Process, xrefs: 0097DFFC

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLastLibraryLoad
String ID: IsWow64Process$IsWow64Process fail$XProcess.IsWow64Process$kernel32.dll
API String ID: 3568775529-2376343126
Opcode ID: b5b051276d7c14a0479d9056e4b87ba08fac04c2439eab560247390c65c43422
Instruction ID: 4923cb78474d57c2d3ceb6ffced986cc884d287340bde380e8fea7d63811af22
Opcode Fuzzy Hash: b5b051276d7c14a0479d9056e4b87ba08fac04c2439eab560247390c65c43422
Instruction Fuzzy Hash: 7D11943194D244DECB20DBA8D845BAD7BB96B19304F0485DAE40897291D3F94681D793

Uniqueness

Uniqueness Score: -1.00%

Function 00409A74, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409B28,?,00000000,?,00000000,00409C4E,00409C68,?,?,0040E5FC), ref: 00409AAD
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409B28,?,00000000,?,00000000,00409C4E,00409C68), ref: 00409AB3
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409B28,?,00000000,?), ref: 00409ACE
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409B28,?,00000000), ref: 00409AD4

Strings

Error, xrefs: 00409AE6
Runtime error at 00000000, xrefs: 00409AA6, 00409AEB

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: cf1c3a1a8a71e0ce7cec7e5f85c8d2345542083157991c0599daa759868a6031
Instruction ID: f74c3fd3ee91bb432393e3b317b2e6d52e34f783443ed57594fd7085189e639f
Opcode Fuzzy Hash: cf1c3a1a8a71e0ce7cec7e5f85c8d2345542083157991c0599daa759868a6031
Instruction Fuzzy Hash: 49F0C2E06D934479EA10B3915C06FAA224CABD1F19F10413BB210B90D3C6BC48C0A7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004202D0, Relevance: 9.2, APIs: 6, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,?), ref: 0042032D
CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000001,00000000,?,?), ref: 004203C3
MapViewOfFile.KERNEL32(000003EE,00000004,00000000,00000000,00000001,00000000,0042049C,?,?,00000000,00000002,00000000,00000001,00000000,?), ref: 004203F2
GetCurrentProcess.KERNEL32(00000104,00000000,0042047E,?,000003EE,00000004,00000000,00000000,00000001,00000000,0042049C,?,?,00000000,00000002,00000000), ref: 00420417
UnmapViewOfFile.KERNEL32(00000000,00420485,?,000003EE,00000004,00000000,00000000,00000001,00000000,0042049C,?,?,00000000,00000002,00000000,00000001), ref: 00420478

Part of subcall function 004200A8: GetLogicalDriveStringsW.KERNEL32(00000104,?,00000000,004201D6,?,00000000,?,00000000), ref: 004200E5
Part of subcall function 004200A8: QueryDosDeviceW.KERNEL32(?,?,00000104,00000104,?,00000000,004201D6,?,00000000,?,00000000), ref: 0042010F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$View$CreateCurrentDeviceDriveLogicalMappingProcessQuerySizeStringsUnmap
String ID:
API String ID: 435433801-0
Opcode ID: b0fdbd1805bf485ad99ae4e852558d5830ff23f68edbe7e5b34d28334620c400
Instruction ID: 524eb8e046d2160f06c98bf78628f9fd0efa1d6b01d2360ad1dd8c6c29fbebff
Opcode Fuzzy Hash: b0fdbd1805bf485ad99ae4e852558d5830ff23f68edbe7e5b34d28334620c400
Instruction Fuzzy Hash: DA514F70A00319AFDB10EFA5DC95B9EB7F5EB48304F9044AAE504A7291D77C9E84CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00714DD4, Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(009D9488,00000000,00714F02,?,?,?,00000001), ref: 00714DF5
VirtualProtect.KERNEL32(00000000,00000000,00000040,?,00000000,00000000,00714EBD,?,009D9488,00000000,00714F02,?,?,?,00000001), ref: 00714E7D
VirtualProtect.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000040,?,00000000,00000000,00714EBD,?,009D9488,00000000,00714F02), ref: 00714EAE
LeaveCriticalSection.KERNEL32(009D9488,009D9488,00000000,00714F02,?,?,?,00000001), ref: 00714ED8
GetCurrentProcess.KERNEL32(00000000,00000000,009D9488,009D9488,00000000,00714F02,?,?,?,00000001), ref: 00714EE1
FlushInstructionCache.KERNEL32(00000000,00000000,00000000,009D9488,009D9488,00000000,00714F02,?,?,?,00000001), ref: 00714EE7

Part of subcall function 006C24D4: VirtualQuery.KERNEL32(00000000,0000001C,0000001C), ref: 006C24E5

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Virtual$CriticalProtectSection$CacheCurrentEnterFlushInstructionLeaveProcessQuery
String ID:
API String ID: 2254175395-0
Opcode ID: 562f5d261096143d7163aee829d9756d3bdc0817bd0f9480662ad133491eb194
Instruction ID: bddfd50415d298a0262457cadff3bec9a94bef605a98680399d3651973983100
Opcode Fuzzy Hash: 562f5d261096143d7163aee829d9756d3bdc0817bd0f9480662ad133491eb194
Instruction Fuzzy Hash: 69317470644204AFDB00EB69CC82E9A77E8EB49704F1080B9F804EB296D779DD55C769

Uniqueness

Uniqueness Score: -1.00%

Function 00714F10, Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(009D9488,00000000,0071503E,?,?,?,00000001), ref: 00714F31
VirtualProtect.KERNEL32(00000000,00000000,00000040,?,00000000,00000000,00714FF9,?,009D9488,00000000,0071503E,?,?,?,00000001), ref: 00714FB9
VirtualProtect.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000040,?,00000000,00000000,00714FF9,?,009D9488,00000000,0071503E), ref: 00714FEA
LeaveCriticalSection.KERNEL32(009D9488,009D9488,00000000,0071503E,?,?,?,00000001), ref: 00715014
GetCurrentProcess.KERNEL32(00000000,00000000,009D9488,009D9488,00000000,0071503E,?,?,?,00000001), ref: 0071501D
FlushInstructionCache.KERNEL32(00000000,00000000,00000000,009D9488,009D9488,00000000,0071503E,?,?,?,00000001), ref: 00715023

Part of subcall function 006C24D4: VirtualQuery.KERNEL32(00000000,0000001C,0000001C), ref: 006C24E5

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Virtual$CriticalProtectSection$CacheCurrentEnterFlushInstructionLeaveProcessQuery
String ID:
API String ID: 2254175395-0
Opcode ID: a7dbd019f0b4eadc7ef86e6a993ed7bb3169268dd783ec4d596ffc50e1704682
Instruction ID: e4adc2187ac98c2ba4f58b92fed7cdd7e7e98c35eaf2bc16eac0e5cc8d44ea16
Opcode Fuzzy Hash: a7dbd019f0b4eadc7ef86e6a993ed7bb3169268dd783ec4d596ffc50e1704682
Instruction Fuzzy Hash: 22318470644204AFDB40EBA9CC92E9A77F8EB49708F1040B9F804EB396D779DD51CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004D7C0C, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004D7C5A
GetSystemMetrics.USER32 ref: 004D7C66
GetDC.USER32(00000000), ref: 004D7C82
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004D7CA9
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004D7CB6
ReleaseDC.USER32 ref: 004D7CEF

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 93e08391c8fcbe002d6dcc2ff14ba5c117e9c42000ee2850ba2d3b6b2913b71b
Instruction ID: 44ea6b9a2f8cd541af5dc3fca111dd50dcf0e513f35c9ca2e5dcc0914662475f
Opcode Fuzzy Hash: 93e08391c8fcbe002d6dcc2ff14ba5c117e9c42000ee2850ba2d3b6b2913b71b
Instruction Fuzzy Hash: 34318270A04204EFDB10DF65C951AAEBBF5FB49710F10816BF914EB381D678AD41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 009847FC, Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00984BA6

Strings

%userpath%, xrefs: 009848CA
%s : Multiple logs: %s Count: %d, xrefs: 00984A87
%s %s, xrefs: 00984B39
Multiple errors: %s Count: %d, xrefs: 009849B2

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentThread
String ID: %s %s$%s : Multiple logs: %s Count: %d$%userpath%$Multiple errors: %s Count: %d
API String ID: 2882836952-4227814390
Opcode ID: e614976c58c789b9e28e2382212cd7ce940484a8343195d75ed57a2524eb87b5
Instruction ID: 74d0ec980c0ed3383c04ed1365e7d749f4794d0e0b623e84d239f37a5bfb81e3
Opcode Fuzzy Hash: e614976c58c789b9e28e2382212cd7ce940484a8343195d75ed57a2524eb87b5
Instruction Fuzzy Hash: 17E14A30A0424A9FCB10EFA9D984BDDBBF5FF44314F60816AE440AB362DB34AE45DB55

Uniqueness

Uniqueness Score: -1.00%

Function 006E26F4, Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(00000000,00000008,?,00000000,?,?), ref: 006E270A
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,00000000,00000008,?,00000000,?,?), ref: 006E2726
LocalAlloc.KERNEL32(00000040,?,?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008,?,00000000,?,?), ref: 006E2733
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,?,?,00000040,?,?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008,?,00000000), ref: 006E274D
LocalFree.KERNEL32(00000000,?,TokenIntegrityLevel,?,?,?,00000040,?,?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008,?), ref: 006E275D
CloseHandle.KERNEL32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000040,?,?,TokenIntegrityLevel,00000000,00000000,?,00000000,00000008), ref: 006E2766

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocCloseFreeHandleOpenProcess
String ID:
API String ID: 169919644-0
Opcode ID: afac3cf7a85d786b67cd8c56e3c6a9ec54f0a6331affd1dad7ec18390695ac14
Instruction ID: fd4b22b4b49cc5cd5d9d9d1ea5753856882b8ad545a25fb6177eedd36ed82e69
Opcode Fuzzy Hash: afac3cf7a85d786b67cd8c56e3c6a9ec54f0a6331affd1dad7ec18390695ac14
Instruction Fuzzy Hash: CC016176644208BFEB10DBE98C82FEEB7ECDF05714F100066FA44E7281E574E9404768

Uniqueness

Uniqueness Score: -1.00%

Function 007E2EAB, Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 55COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 007E2EF1

Strings

.dump, xrefs: 007E2EB7, 007E2EDD
CheckAfterRestart, xrefs: 007E2F15
CheckInstallationAfterReboot.CheckFile, xrefs: 007E2EFC
Settings, xrefs: 007E2F1A
TrySaveStringList failed, xrefs: 007E2EF7

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: .dump$CheckAfterRestart$CheckInstallationAfterReboot.CheckFile$Settings$TrySaveStringList failed
API String ID: 1452528299-495211755
Opcode ID: 5abbd4221b610af05d6f3b5117e16075a7e0133c29916082b033b1ca41e1f9d6
Instruction ID: e18b20ede8965e58bf8b2eddc21997e95321b274ebf9c8ebde81eec9cf466f42
Opcode Fuzzy Hash: 5abbd4221b610af05d6f3b5117e16075a7e0133c29916082b033b1ca41e1f9d6
Instruction Fuzzy Hash: 76113331A011489BDB04FB65D992A9EB3B5EF48344F5081BAF504BB3D2CF38DE498B58

Uniqueness

Uniqueness Score: -1.00%

Function 006F2258, Relevance: 9.0, APIs: 6, Instructions: 40threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006F2264
InterlockedIncrement.KERNEL32(009BD0B8), ref: 006F2281
CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000,00000001,0071518A,?,007F6BC3,00000000,007F6EDB,?,00000000,007F6F10), ref: 006F2292
InterlockedDecrement.KERNEL32(009BD0B8), ref: 006F22A3
SetEvent.KERNEL32(00000000,009BD0B8,00000001,0071518A,?,007F6BC3,00000000,007F6EDB,?,00000000,007F6F10), ref: 006F22BB
CloseHandle.KERNEL32(00000000,00000000,009BD0B8,00000001,0071518A,?,007F6BC3,00000000,007F6EDB,?,00000000,007F6F10), ref: 006F22C6

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: EventInterlocked$CloseCreateCurrentDecrementHandleIncrementThread
String ID:
API String ID: 1434811812-0
Opcode ID: 854c53ea9d61040110291828fa4cc4f6e57048b181b60a6c4518ec800be93eb5
Instruction ID: c08577623b0ae338cccd04658f3b1c5d4e858a246a8da5a4399a58cd095657f1
Opcode Fuzzy Hash: 854c53ea9d61040110291828fa4cc4f6e57048b181b60a6c4518ec800be93eb5
Instruction Fuzzy Hash: 9801C87426E206DAD750FB759F417E532D39B04328F50061ABB04C32B1F37485C2AF2A

Uniqueness

Uniqueness Score: -1.00%

Function 005B68F4, Relevance: 9.0, APIs: 6, Instructions: 40threadCOMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32(00000000), ref: 005B6906
InterlockedExchange.KERNEL32(?,00000000), ref: 005B6921
SetEvent.KERNEL32(00000000,?,00000000), ref: 005B6935
GetCurrentThreadId.KERNEL32 ref: 005B693A
MsgWaitForMultipleObjects.USER32 ref: 005B6963
CloseHandle.KERNEL32(00000000,00000000,?,00000000), ref: 005B6970

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CloseCurrentEventExchangeHandleHookInterlockedMultipleObjectsThreadUnhookWaitWindows
String ID:
API String ID: 2988543691-0
Opcode ID: 2b46a3a7b15892274071a0a6eabe8a5ff92b52099f20b3cc3b90a79c42a99cbd
Instruction ID: ae424c71f9fa0f1acf42e5fdec10b764b012cff8abf805f8f55e3a6b85388066
Opcode Fuzzy Hash: 2b46a3a7b15892274071a0a6eabe8a5ff92b52099f20b3cc3b90a79c42a99cbd
Instruction Fuzzy Hash: 0401867119D301AAD710EBE5DE8AB99B7D8BB04314F14491FF2A4C71E0EB78A4C0E716

Uniqueness

Uniqueness Score: -1.00%

Function 007550D8, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

sqlite3_errcode.SQLITE3(?,00000000,007551F9,?,00000000), ref: 0075511A
sqlite3_errmsg.SQLITE3(?,00000000,007551F9,?,00000000), ref: 0075512B

Strings

"%s" : %s, xrefs: 00755178
DROP TABLE , xrefs: 00755147
No message, xrefs: 007551A5

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: sqlite3_errcodesqlite3_errmsg
String ID: "%s" : %s$DROP TABLE $No message
API String ID: 1373711215-3233140842
Opcode ID: e8a7e4dd6be4b0992c0730a360632582021b851c2aaa2b3373ced50aa3e021c4
Instruction ID: 4779938b09dc5fb1c3f944a29aa59c3676f5fc9a956f77966b5cee9c2c573036
Opcode Fuzzy Hash: e8a7e4dd6be4b0992c0730a360632582021b851c2aaa2b3373ced50aa3e021c4
Instruction Fuzzy Hash: 3F31F870D046099FDB00EFA9C991ADEBBF4EF08305F50407AE814F7292D7B9AE458B65

Uniqueness

Uniqueness Score: -1.00%

Function 00408780, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation,?), ref: 00408796
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040879C
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation,?), ref: 004087B8

Strings

kernel32.dll, xrefs: 00408791
GetLogicalProcessorInformation, xrefs: 0040878C

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-812649623
Opcode ID: f5cac296a5066f00674e97062962d3e138beca7f2223c67bb0b763f38837c084
Instruction ID: 5e984095db6f53c70c9189ec428607b72c663984ce32dc0e0907cd2727502e54
Opcode Fuzzy Hash: f5cac296a5066f00674e97062962d3e138beca7f2223c67bb0b763f38837c084
Instruction Fuzzy Hash: 86117572D04204AEEB10FBA5DE41B5EB7A9EB40314FA0847FE544B22C2DE7C9950C75D

Uniqueness

Uniqueness Score: -1.00%

Function 0097CBB0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(00000000), ref: 0097CBF3
GetLastError.KERNEL32(00000000,00000000), ref: 0097CBFE

Strings

Handle = 0, xrefs: 0097CBCF
LockWindowUpdate fail, xrefs: 0097CC04
XVclUtils.LockWindowUpdate, xrefs: 0097CBD4, 0097CC09

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLastLockUpdateWindow
String ID: Handle = 0$LockWindowUpdate fail$XVclUtils.LockWindowUpdate
API String ID: 644468385-2434498350
Opcode ID: 9d37082c9bb40fdc9f247b7401eeafbb9dd78c0407253ab66cdfb8194cbaa159
Instruction ID: 9f6885ba117d2e5c442e311bca5f6be467091681b59ce6881970c1406b3a963f
Opcode Fuzzy Hash: 9d37082c9bb40fdc9f247b7401eeafbb9dd78c0407253ab66cdfb8194cbaa159
Instruction Fuzzy Hash: A6F0C8B2688308DFD724EB91FA02B1933D8D744725F24881EF15C9BA81D6B45DC0E715

Uniqueness

Uniqueness Score: -1.00%

Function 00406DA4, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 00406DDB
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 00406DE1
GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 00406DF0
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 00406E01

Strings

:, xrefs: 00406DC0

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 09bcaab9a673cbb8d540c0be19fbe43f5ab5dfeb96d9babdaa8ec741301c0c9e
Instruction ID: a1f25672f415b7902a75a7e6f63559bd4c3f6b60d628128771ec2b440115bcab
Opcode Fuzzy Hash: 09bcaab9a673cbb8d540c0be19fbe43f5ab5dfeb96d9babdaa8ec741301c0c9e
Instruction Fuzzy Hash: 5BF0CDA1154741A6D310E350C852AEB739DDF84304F01842E7AD8D72D0E77C8898A3AB

Uniqueness

Uniqueness Score: -1.00%

Function 007568D8, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 007566D4: LoadLibraryW.KERNEL32(Setupapi.dll), ref: 007566F1
Part of subcall function 007566D4: GetLastError.KERNEL32 ref: 0075674A

GetLastError.KERNEL32(00000000,?,00000FD0,?,?,00000000,00756A8D,?,?,?), ref: 007569F9

Strings

SetupDiGetDeviceProperty fail, xrefs: 00756A5B
,, xrefs: 007569C1
ERROR: , xrefs: 00756A10
ReadDeviceStringProperty, xrefs: 00756A60

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$LibraryLoad
String ID: ,$ERROR: $ReadDeviceStringProperty$SetupDiGetDeviceProperty fail
API String ID: 1136134869-2712009917
Opcode ID: 23c0e1015c84580332f722b7c73c467578873c01fc40c32e66b3119472798c4d
Instruction ID: 3f86afe9d633d2b598866c5f57172a6254327c6b4c25041a4704b6bc6e352e2e
Opcode Fuzzy Hash: 23c0e1015c84580332f722b7c73c467578873c01fc40c32e66b3119472798c4d
Instruction Fuzzy Hash: 57419070D002599FDB10DF95CC45AEEB7B5EF48305F8084AAE904F7290D7B8AE89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 005AD398, Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

FlatSB_SetScrollProp.COMCTL32(00000000,00000001,?,00000000,?,00000000,?,005AD54D,?,00000000,00000011,00000000), ref: 005AD3D6
FlatSB_SetScrollProp.COMCTL32(00000000,00000001,?,00000000,00000000,00000001,?,00000000,?,00000000,?,005AD54D,?,00000000,00000011,00000000), ref: 005AD407
FlatSB_SetScrollProp.COMCTL32(00000000,00000001,?,00000000,00000000,00000001,?,00000000,?,00000000,?,005AD54D,?,00000000,00000011,00000000), ref: 005AD438
FlatSB_SetScrollProp.COMCTL32(00000000,00000001,?,00000000,00000000,00000001,?,00000000,?,00000000,?,005AD54D,?,00000000,00000011,00000000), ref: 005AD469
FlatSB_SetScrollProp.COMCTL32(00000000,?,00000000,00000000,00000000,00000001,?,00000000,?,00000000,?,005AD54D,?,00000000,00000011,00000000), ref: 005AD497

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FlatPropScroll
String ID:
API String ID: 3625857538-0
Opcode ID: 661c1ed8e591b7443948445f290934c2e03ec6ecd830a8582d5754c49f1979c1
Instruction ID: ccdb5392d60e7b6dfd70a2fc6ec8d9b1a3a399279e1c38d1a6dbe951bd8cfcca
Opcode Fuzzy Hash: 661c1ed8e591b7443948445f290934c2e03ec6ecd830a8582d5754c49f1979c1
Instruction Fuzzy Hash: E031D274600044AFDB50EF9DD985E26BBE8BB1E308F550499F288DB262C736ED50DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 007AF75C, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?), ref: 007AF805

Strings

GUID=, xrefs: 007AF830
GetFriendlyClassName, xrefs: 007AF84A
Unknown, xrefs: 007AF85C
SetupDiGetClassDescription fail, xrefs: 007AF845

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: GUID=$GetFriendlyClassName$SetupDiGetClassDescription fail$Unknown
API String ID: 1452528299-2576105542
Opcode ID: e0e680921617914f003de2b95b7022a7713af49f3ab761ed0809a6bc3d36584a
Instruction ID: 69741791cbbc23d7c9cedf2022e9302849e78e4dc09db60c27b95d2ecd1e965b
Opcode Fuzzy Hash: e0e680921617914f003de2b95b7022a7713af49f3ab761ed0809a6bc3d36584a
Instruction Fuzzy Hash: 98316D75A0021A9FCB20DF99C881AAEB7F9FF89304F4041BAE408A7750D778AE44DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0075A27C, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?), ref: 0075A2E0
GetLastError.KERNEL32(?,?,00000000,?,?,?), ref: 0075A30D

Strings

SetupDiGetDeviceRegistryProperty fail, xrefs: 0075A313
PropertyIndex=, xrefs: 0075A2FF
ReadRegistryDwordProperty, xrefs: 0075A318

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: PropertyIndex=$ReadRegistryDwordProperty$SetupDiGetDeviceRegistryProperty fail
API String ID: 1452528299-2170811707
Opcode ID: 44d7cb9fc73bb7230bad30135c7e9c9c1d39a6711a24e054cfefc3faf4706b01
Instruction ID: 55ccd91905673264b416b00f04d425d597a98082997ad53d242d7d56735aadd6
Opcode Fuzzy Hash: 44d7cb9fc73bb7230bad30135c7e9c9c1d39a6711a24e054cfefc3faf4706b01
Instruction Fuzzy Hash: F32128B6A00208BFCB05DFA9DC80DEEBBF9FB48304F51457AB904E3250D6789A048B65

Uniqueness

Uniqueness Score: -1.00%

Function 006F6ECC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 006E68BC: FindResourceA.KERNEL32(00400000,TMADEXCEPT,0000000A), ref: 006E68C4

GetModuleHandleW.KERNEL32(madExceptIde_.bpl,00000000,006F7039,?,?,00400000,?), ref: 006F6F3B
GetModuleFileNameA.KERNEL32(00000000,?,00000004,00000000,007F6BDD,0000001C,madExceptIde_.bpl,00000000,006F7039,?,?,00400000,?), ref: 006F6FA0
VirtualQuery.KERNEL32(00000000,007F6BDD,0000001C,madExceptIde_.bpl,00000000,006F7039,?,?,00400000,?), ref: 006F7015

Strings

madExceptIde_.bpl, xrefs: 006F6F36

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Module$FileFindHandleNameQueryResourceVirtual
String ID: madExceptIde_.bpl
API String ID: 4047953117-1018132612
Opcode ID: 0dcc42e75ce7d8c5f5a92251fd2f9191b938f02d529c78f94df7169ebf0bb966
Instruction ID: 7d32130aac132ceecbb5948e33a8f1fc1dd6d7e0de8af42ba2df74c3a799d4c0
Opcode Fuzzy Hash: 0dcc42e75ce7d8c5f5a92251fd2f9191b938f02d529c78f94df7169ebf0bb966
Instruction Fuzzy Hash: B741AD30A012098BDB21EF69D982BED73B7AF95314F144278FA00AB395DB36ED05C755

Uniqueness

Uniqueness Score: -1.00%

Function 006BD3B4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,?,006FE05D,77777777,00000000,?,00000000,00400000,00400000,00000000,00000000,00000000,?,006E74E0,00400000,00000000), ref: 006BD3DE
GetModuleHandleW.KERNEL32(kernel32.dll,WideCharToMultiByte,?,?,006FE05D,77777777,00000000,?,00000000,00400000,00400000,00000000,00000000,00000000,?,006E74E0), ref: 006BD3F4

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Strings

WideCharToMultiByte, xrefs: 006BD3EA
kernel32.dll, xrefs: 006BD3EF

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID: WideCharToMultiByte$kernel32.dll
API String ID: 3310240892-992036916
Opcode ID: d16a8536f85f98ae2e822456d0dcf57136da59b84cb300f49743bc83cd46df96
Instruction ID: ee48ed52251e9d86bbe8a63235368e59ca5db181a7c31f9bdeb06fd01532cdd4
Opcode Fuzzy Hash: d16a8536f85f98ae2e822456d0dcf57136da59b84cb300f49743bc83cd46df96
Instruction Fuzzy Hash: 8A316DB16486205FD724F62D8882B9D22C55B02348F0144BAF441EF2D7DABDECD6939A

Uniqueness

Uniqueness Score: -1.00%

Function 006BD178, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00000001,006BABAC,-00000006,006E6BE2,00000000,00000000,00400000,00000000,00000000,00000000,006BABAC,00000001,00000000,00000000,00000000), ref: 006BD1A5
GetModuleHandleW.KERNEL32(kernel32.dll,MultiByteToWideChar,?,00000001,006BABAC,-00000006,006E6BE2,00000000,00000000,00400000,00000000,00000000,00000000,006BABAC,00000001,00000000), ref: 006BD1BB

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Strings

MultiByteToWideChar, xrefs: 006BD1B1
kernel32.dll, xrefs: 006BD1B6

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID: MultiByteToWideChar$kernel32.dll
API String ID: 3310240892-2998143648
Opcode ID: f3a3af1864e51b77b3f690c8f68bf7d6338524c853bbd66996f746fb880ecd6a
Instruction ID: ef7e1fb170c2fe3bc9e3dc3fc4a330b280ef294a6e15450c3836116329ccc67e
Opcode Fuzzy Hash: f3a3af1864e51b77b3f690c8f68bf7d6338524c853bbd66996f746fb880ecd6a
Instruction Fuzzy Hash: 1D3186B02487419BD710FB2DC586A9E72E5AF44388F11443EF185DB392EA79CCC2974A

Uniqueness

Uniqueness Score: -1.00%

Function 005087C4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(00000001), ref: 005087DF
ScrollWindow.USER32 ref: 0050880E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014), ref: 00508884

Strings

twO, xrefs: 00508831

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Window$ScrollVisible
String ID: twO
API String ID: 4127837035-715434670
Opcode ID: 975635b0c8825c7e964ec775364072d0bcd7ce94993619facb4832fdde0d7c53
Instruction ID: f23ea70412aff0e234f7e399b8403c78f4fcd9996d5e45bb447851c613f118c2
Opcode Fuzzy Hash: 975635b0c8825c7e964ec775364072d0bcd7ce94993619facb4832fdde0d7c53
Instruction Fuzzy Hash: 29219C71704700AFD714DAA9CC88F6EBBE4BFC8710F18896DF588CB2A6DA35D8858751

Uniqueness

Uniqueness Score: -1.00%

Function 004A7008, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(004A5334,00000004,004A5330,?,?,?,?,?,?,?,?,?,?,00000000,004A70DE), ref: 004A7080
GetCurrentThread.KERNEL32 ref: 004A70B8
GetCurrentThreadId.KERNEL32 ref: 004A70C0

Strings

tEA, xrefs: 004A709F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentThread$ErrorLast
String ID: tEA
API String ID: 4172138867-544003032
Opcode ID: 26d4dfd4f9de0b6f844cc0c90a4e39c38da02f338c13eb6acaa3a8ca35573890
Instruction ID: c4c95b402820917370fc5874d94c939630ce62c4f1bbe14d2674cbb6d5b69740
Opcode Fuzzy Hash: 26d4dfd4f9de0b6f844cc0c90a4e39c38da02f338c13eb6acaa3a8ca35573890
Instruction Fuzzy Hash: E5216630A0C645AEC720EBB68C417ABBBA4BF66304F44C52BE41097781DB7C9814C79D

Uniqueness

Uniqueness Score: -1.00%

Function 0096C828, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55networkCOMMON

Download Yara Rule

APIs

HttpAddRequestHeadersW.WININET(?,00000000,00000000,A0000000), ref: 0096C88D
GetLastError.KERNEL32(?,00000000,0096C8CA), ref: 0096C89A

Strings

XInternet.AddHttpHeader, xrefs: 0096C8A5
HttpAddRequestHeaders fail, xrefs: 0096C8A0

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorHeadersHttpLastRequest
String ID: HttpAddRequestHeaders fail$XInternet.AddHttpHeader
API String ID: 2189517503-3385844265
Opcode ID: 092f0c7c132a040f44c0712b3c64f69bbebabe67196547cb650a6ec46bc662ef
Instruction ID: aee056906ca72f2592bfbd405e7b2904705722b5ceace68279d3c24da96d4fd3
Opcode Fuzzy Hash: 092f0c7c132a040f44c0712b3c64f69bbebabe67196547cb650a6ec46bc662ef
Instruction Fuzzy Hash: EE113AB0E04209AFDB24EFA9C8419BEB7F8EB88304F40457AF421E3391D734AA00DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0042F350, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042F35F

Strings

`B, xrefs: 0042F3A0

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID: `B
API String ID: 1473721057-3602356314
Opcode ID: 505bbdd722829348f2f1122914cfc8884ff3d8bfb03a3bf8bdc7d45367d9e4ae
Instruction ID: 0f04abc276279d13ed2996c086ff4464770d7b5fd7e08926521cd607af25b040
Opcode Fuzzy Hash: 505bbdd722829348f2f1122914cfc8884ff3d8bfb03a3bf8bdc7d45367d9e4ae
Instruction Fuzzy Hash: 4D015231B1413486CB10EB35E9C56A923B5AF55308BF4447BAC06AB256CB2DCC4ED3AF

Uniqueness

Uniqueness Score: -1.00%

Function 00554688, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00000001,00000000,00554707,?,?,00000000,00000000,?,00554721,00883ED2,?,?,?,00000000,?), ref: 005546A5
SetTimer.USER32(?,00000001,?,00000000), ref: 005546C7

Part of subcall function 0040E310: LoadStringW.USER32(00000000,00010000,00001000,00001000), ref: 0040E355

Strings

<L, xrefs: 005546D3
0NG, xrefs: 005546E2

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Timer$KillLoadString
String ID: 0NG$<L
API String ID: 1423459280-3815794942
Opcode ID: a0de5d9fe2ba056847f4fbf1a16995346b7ae0002ef3c5cd815f3d30f6a1aa62
Instruction ID: c7a4a04000c9651abf54f03d6770b2b9bf0b51777f0e7ba880c1d2d28dea9282
Opcode Fuzzy Hash: a0de5d9fe2ba056847f4fbf1a16995346b7ae0002ef3c5cd815f3d30f6a1aa62
Instruction Fuzzy Hash: 9501D430604200BBDB25DF65CD92B993BA8EB45788F4004ABFD009B696D7B6AC94CE54

Uniqueness

Uniqueness Score: -1.00%

Function 00981504, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll), ref: 0098151C

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process,kernel32.dll), ref: 00981545

Strings

kernel32.dll, xrefs: 00981517
IsWow64Process, xrefs: 0098152A

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressCurrentLibraryLoadProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 353374858-3024904723
Opcode ID: f4012070eacb9e88f401480aca6226824666673165f02d0ba01e4542da475515
Instruction ID: ce33af59bc6d1bd33c11dd124c1272cb70a4f3f3831c3bac426e0c8d4ce0c890
Opcode Fuzzy Hash: f4012070eacb9e88f401480aca6226824666673165f02d0ba01e4542da475515
Instruction Fuzzy Hash: 2A017134C5D388AECB11EBF488087EDBFBC5B55308F0445DAE492A2392D77D428ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 0097CCC8, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(00000000,00887059,00887061), ref: 0097CD25

Strings

XVclUtils.UnlockWindowUpdate, xrefs: 0097CCE8, 0097CD12
FLockCount < 0, xrefs: 0097CCE3
FLockedWindow = 0, xrefs: 0097CD0D

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: LockUpdateWindow
String ID: FLockCount < 0$FLockedWindow = 0$XVclUtils.UnlockWindowUpdate
API String ID: 1864878196-334504553
Opcode ID: d9c710d9bf4e8526013f7a7cfdc3b66cfc776fc7a980b24b1ddb8b56d4539def
Instruction ID: 0b5cf49b6745c8533d1d8c144d41c194dcf61cb15d563bb84e557105a923e55d
Opcode Fuzzy Hash: d9c710d9bf4e8526013f7a7cfdc3b66cfc776fc7a980b24b1ddb8b56d4539def
Instruction Fuzzy Hash: B9F01CB3299202DAE738AB15EE06B1537A1E780B16F11C53FB1196AED0C7F458D1EB06

Uniqueness

Uniqueness Score: -1.00%

Function 0040D00C, Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040D01D
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040D07B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040D0D8
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040D10B

Part of subcall function 0040CFC8: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040D089), ref: 0040CFDF
Part of subcall function 0040CFC8: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040D089), ref: 0040CFFC

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 7bbc8eb85145729c2afb1b1326061a418c39986cb2f8682a97f1898dbe79d6ad
Instruction ID: 9312f76922126b1844d7c0ebac1c5326f3d7faaf0088cf31ef4bd8309b250bb8
Opcode Fuzzy Hash: 7bbc8eb85145729c2afb1b1326061a418c39986cb2f8682a97f1898dbe79d6ad
Instruction Fuzzy Hash: 9E319E70E1021A9BCB10EFE9C880AAEB7B9FF04318F40457AE515FB2D1DB789A458B55

Uniqueness

Uniqueness Score: -1.00%

Function 00759904, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?), ref: 007599AA

Strings

ReadRegistryStringProperty, xrefs: 007599E6
SetupDiGetDeviceRegistryProperty fail, xrefs: 007599E1
ERROR: , xrefs: 007599D1

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: ERROR: $ReadRegistryStringProperty$SetupDiGetDeviceRegistryProperty fail
API String ID: 1452528299-1228017103
Opcode ID: 5842103aa39a839d7cbe207e04d432e8ae64b709b3fe8cbd663b5a5fff8085d6
Instruction ID: 6f19fe825256e437fc81d1e789cca1df397df2be848e73074a0ba041c477bd4f
Opcode Fuzzy Hash: 5842103aa39a839d7cbe207e04d432e8ae64b709b3fe8cbd663b5a5fff8085d6
Instruction Fuzzy Hash: B73141B5A00158EFDB10DF99CC819DEB7F9EB48300F50816AAA48E3251D7B89E85CB65

Uniqueness

Uniqueness Score: -1.00%

Function 005B7620, Relevance: 6.1, APIs: 4, Instructions: 85threadwindowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000004), ref: 005B7632
GetWindowThreadProcessId.USER32(?,?), ref: 005B764F
GetCurrentProcessId.KERNEL32(?,00000004), ref: 005B765B
IsWindowVisible.USER32(?), ref: 005B76B5

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Window$Process$CurrentThreadVisible
String ID:
API String ID: 3926708836-0
Opcode ID: dab83a2438cbc1b3f6d07135478f1fd6fa28e208c92c168bf445f94b82d3c337
Instruction ID: b823b0078f557cd80fde28c81288146aa097bc466f4c75b9b43173bd926a4361
Opcode Fuzzy Hash: dab83a2438cbc1b3f6d07135478f1fd6fa28e208c92c168bf445f94b82d3c337
Instruction Fuzzy Hash: 75318D3561820A9FCB10DFA9D8C0AAA77A4FB88340F6401B6E91497356EB30FD40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 006E68D8, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,006BABAC,-00000001,006F6DBA,?,006E6B43,00000000,00000000,00000000,00000000,00000001,006BABAC,00000001,00000000), ref: 006E68FA
LocalFree.KERNEL32(006BABAC,00000040,?,00000001,006BABAC,-00000001,006F6DBA,?,006E6B43,00000000,00000000,00000000,00000000,00000001,006BABAC,00000001), ref: 006E6915
LocalAlloc.KERNEL32(00000040,3mo,00000001,006BABAC,-00000001,006F6DBA,?,006E6B43,00000000,00000000,00000000,00000000,00000001,006BABAC,00000001,00000000), ref: 006E6926

Strings

3mo, xrefs: 006E691F, 006E6942, 006E6923

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Local$Alloc$Free
String ID: 3mo
API String ID: 209276640-3560107000
Opcode ID: 95b6538dd70f2bad68521a0234e9f6c37ab20badcc45ec649d3a550c91bd9487
Instruction ID: 23ac3b5482f9ec64b15f8889203194248bbdd053f95cd71687d7d358f2f4745b
Opcode Fuzzy Hash: 95b6538dd70f2bad68521a0234e9f6c37ab20badcc45ec649d3a550c91bd9487
Instruction Fuzzy Hash: F1317C35604265DFCB00DF29C491A9A77F6EF5A314B2180A9FA449F366CB34ED01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005B8234, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,005B8E3C), ref: 005B8261

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: a4c9b601c7702a80ca6ab0afc5577673751a970f7627be93275ebd7f4b02ab22
Instruction ID: 4d09cbef714139e6dbb5767f65e542b04131a5a9a988127849070bd0bb577ad4
Opcode Fuzzy Hash: a4c9b601c7702a80ca6ab0afc5577673751a970f7627be93275ebd7f4b02ab22
Instruction Fuzzy Hash: 702115702002819BEB24EA68C9C9BEA3B997B44704F0814B5BD04DF29BDA64EC81C760

Uniqueness

Uniqueness Score: -1.00%

Function 0042238C, Relevance: 6.1, APIs: 4, Instructions: 59timefileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?), ref: 0042239D
GetLastError.KERNEL32(?,?), ref: 004223A6
FileTimeToLocalFileTime.KERNEL32(?), ref: 004223C4
FileTimeToDosDateTime.KERNEL32 ref: 004223E3

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileTime$DateErrorFindLastLocalNext
String ID:
API String ID: 2103556486-0
Opcode ID: 1afea777a5436f16d6eed0149a9771debf6bf2eac93dd77b81b35a80f6423534
Instruction ID: f6e1dc4814698e12159ada067b526e8407f6228a00b76a2fa08346e364f3d6dc
Opcode Fuzzy Hash: 1afea777a5436f16d6eed0149a9771debf6bf2eac93dd77b81b35a80f6423534
Instruction Fuzzy Hash: 6B114FB1604301AFCB44DF69C8C189777EDBF8C304B44896AFD58CB20AE778D8508BA6

Uniqueness

Uniqueness Score: -1.00%

Function 004DE5C8, Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(00000000,?), ref: 004DE5E9
GetObjectW.GDI32(?,00000018,?,00000000,004DE645,?,00000001,00000000,00983A23,?,00000000,00983A55), ref: 004DE60A
DeleteObject.GDI32(?), ref: 004DE636
DeleteObject.GDI32(?), ref: 004DE63F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: b66ba89125ab25aca8113f60d61867c4f359fe9794182178e3059c2ccf2a109d
Instruction ID: c1d8e21a39d63e4cd6901e5e5be143396905271bb5ba089ad582d7d1dd268351
Opcode Fuzzy Hash: b66ba89125ab25aca8113f60d61867c4f359fe9794182178e3059c2ccf2a109d
Instruction Fuzzy Hash: B4117375A04208AFDB04EFA6D991D9EB7F9EB48314B5480ABF904D7351DB74ED008B54

Uniqueness

Uniqueness Score: -1.00%

Function 005B744C, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnumWindows.USER32(005B7388), ref: 005B7479
GetWindow.USER32(00000003,00000003), ref: 005B7491
GetWindowLongW.USER32(00000000,000000EC), ref: 005B749E
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000213,00000000,000000EC), ref: 005B74DD

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: 8113ef21bdb22f61011c7d7a9886f77d5659e8ef27a5aa1ff26cc21bfd694f2f
Instruction ID: 76d0135fcf705c16a5318437db928dea6f67fe8ed73d6141e8f092f279eadfde
Opcode Fuzzy Hash: 8113ef21bdb22f61011c7d7a9886f77d5659e8ef27a5aa1ff26cc21bfd694f2f
Instruction Fuzzy Hash: E0119E30608710AFDE20AA188C85FD67A98AB89725F144169F998EB1D2C670AC818761

Uniqueness

Uniqueness Score: -1.00%

Function 0049BE70, Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000000,0047C598,00000000,00000001,00000000,?,0049BDB2,00000000,004963F3,?,004963EF,00000000,?,00494BE5), ref: 0049BE87
LoadResource.KERNEL32(00000000,0049BF0C,00000000,?,00000000,0047C598,00000000,00000001,00000000,?,0049BDB2,00000000,004963F3,?,004963EF,00000000), ref: 0049BEA1
SizeofResource.KERNEL32(00000000,0049BF0C,00000000,0049BF0C,00000000,?,00000000,0047C598,00000000,00000001,00000000,?,0049BDB2,00000000,004963F3,?), ref: 0049BEBB
LockResource.KERNEL32(0049B778,00000000,00000000,0049BF0C,00000000,0049BF0C,00000000,?,00000000,0047C598,00000000,00000001,00000000,?,0049BDB2,00000000), ref: 0049BEC5

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 535e5529c689c5c6e009d760390887e6023fb869dde35de32744bbc3debea581
Instruction ID: 783d009a5b49b9a5a124733a015472aa5b1214a5ac63180d94092cc1db63dd23
Opcode Fuzzy Hash: 535e5529c689c5c6e009d760390887e6023fb869dde35de32744bbc3debea581
Instruction Fuzzy Hash: 2AF06D726042046F5B44EEAEA981D9F7BECEE88264310016FF918D7302DA78DD1143BC

Uniqueness

Uniqueness Score: -1.00%

Function 004FC44C, Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004FC459
GetCurrentProcessId.KERNEL32(?,00000000,00000000,005BA791,?,?,00000000,00000001,005B8AAB,?,00000000,00000000,00000000,00000000), ref: 004FC462
GlobalFindAtomW.KERNEL32(00000000), ref: 004FC477
GetPropW.USER32(00000000,00000000), ref: 004FC48E

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: e0c5b893b642a461026c9a74cbe91dc246320f8f38a30035cd72af0b52ba65f5
Instruction ID: 4c8b3a0adc47f3074d25ba56fa6e77a5c2d8c8fcc71d77d03e2c54cbee1b3a45
Opcode Fuzzy Hash: e0c5b893b642a461026c9a74cbe91dc246320f8f38a30035cd72af0b52ba65f5
Instruction Fuzzy Hash: 86F0ECB121922A1786207BFA9ED587F538C89143B8381053BFB02D3211F62CCC81A3BF

Uniqueness

Uniqueness Score: -1.00%

Function 00421D5C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 004220C4: GetFileAttributesW.KERNEL32(00000000,?,?,?,?,00000000,0097BB75), ref: 004220DA

GetVolumeInformationW.KERNEL32(00000000,?,00000104,00000104,?,?,00000104,00000104), ref: 00421E14
GetDriveTypeW.KERNEL32(00000000,00000000,?,00000104,00000104,?), ref: 00421E39

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

Strings

EA, xrefs: 00421E63

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AttributesFile$DriveInformationTypeVolume
String ID: EA
API String ID: 2660071179-1759796954
Opcode ID: 5baf0bf16688398a8ccb3eb9afe5ffd99e528ce98be5aec2154abe5622af222d
Instruction ID: 56c14fe876bbfc86d0d547fde67107216351c9568cf6a4bcacd4d390566dbdc8
Opcode Fuzzy Hash: 5baf0bf16688398a8ccb3eb9afe5ffd99e528ce98be5aec2154abe5622af222d
Instruction Fuzzy Hash: 6131E874B0011D9BDB10E761EC82BEE77699B14308F854167EC01A32A2DB7C6E45D6AD

Uniqueness

Uniqueness Score: -1.00%

Function 00985BCC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00985C79
SHGetFolderPathW.SHFOLDER(00000000,00000005,00000000,00000000,?,00000000,00985D63,?,?,?,0098360F,?,?,007B4F2F,?,00000000), ref: 00985CDE

Strings

=N, xrefs: 00985C42

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentFolderPathThread
String ID: =N
API String ID: 620518388-532525237
Opcode ID: 1287a11ca3703b50496cfcb210315d2b5b146eae742bbdc413efdd784c10578f
Instruction ID: 8d1809993e9a63a6d4d9f8b1e24152eeda24a4466eaed7a46789c3bec3f174bf
Opcode Fuzzy Hash: 1287a11ca3703b50496cfcb210315d2b5b146eae742bbdc413efdd784c10578f
Instruction Fuzzy Hash: F0417270A04209DFCB14EFA5C982A9EB7F1FF48308F5141AAE404AB392D735AE45DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0098550C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,00985621), ref: 009855CC
CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,00985621), ref: 009855E7

Strings

_prev.log, xrefs: 0098558F

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$Copy$Attributes
String ID: _prev.log
API String ID: 493320244-2189240519
Opcode ID: 9454dc8b0365adb3da666e38992cfce198f149e8615bdc54eec6dffbfb093684
Instruction ID: 84762afd3cc0f702a749e86a3577186cf098b3d074efd1ab05bba452fb3ce8fb
Opcode Fuzzy Hash: 9454dc8b0365adb3da666e38992cfce198f149e8615bdc54eec6dffbfb093684
Instruction Fuzzy Hash: 41314F70A04609EFDB04FFA9D942A9DBBF9EF44304F5241A6F404A73A1D734AE45DB44

Uniqueness

Uniqueness Score: -1.00%

Function 0042FCA0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(?,00738649), ref: 0042FCC8

Part of subcall function 0042F350: VariantClear.OLEAUT32(?), ref: 0042F35F

Strings

`B, xrefs: 0042FD42

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopy
String ID: `B
API String ID: 274517740-3602356314
Opcode ID: 0584bd7551949cf59758a9c31ca2d87aeb82b6f04fc460dcb04044e84b8d4938
Instruction ID: 5ef9dd9d89770f229a3641e1d0435181e30a93ef9a3f7b4789f848f390835627
Opcode Fuzzy Hash: 0584bd7551949cf59758a9c31ca2d87aeb82b6f04fc460dcb04044e84b8d4938
Instruction Fuzzy Hash: DE21862072423086C7209F29E8C166777F5AF49710BD4847BE84B8B35AD63C8C4BD7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004201E4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(NTDLL.DLL,NtQueryObject,?,00000000), ref: 0042020A

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Strings

NTDLL.DLL, xrefs: 00420205
NtQueryObject, xrefs: 00420200

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NTDLL.DLL$NtQueryObject
API String ID: 1646373207-3865875859
Opcode ID: 8b290daa578ebf562e4cbf4bf3ad5fe7a24b0732bb33c5947811302657500e27
Instruction ID: 3511d6151e2b0407f566a7e9a0eac7c822ab8409c451488a26c299325d044cd9
Opcode Fuzzy Hash: 8b290daa578ebf562e4cbf4bf3ad5fe7a24b0732bb33c5947811302657500e27
Instruction Fuzzy Hash: 2911B171744218EFE710EB94FC46B9A77E9FB08714F6005A7F108E3292D7B99D80966C

Uniqueness

Uniqueness Score: -1.00%

Function 005D282C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,GetHandlerProperty), ref: 005D287D

Strings

GetHandlerProperty, xrefs: 005D2856
%s is not a Format library, xrefs: 005D2892

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: %s is not a Format library$GetHandlerProperty
API String ID: 3664257935-1804726876
Opcode ID: b4b6d7b0324f023c960492bd8ff4102fb3f9285158d842c5dbdb1440dd617a6e
Instruction ID: 687b7a7722579d7cc89d03fac911e9588bab17434cc057d7677b0eef5196fa8a
Opcode Fuzzy Hash: b4b6d7b0324f023c960492bd8ff4102fb3f9285158d842c5dbdb1440dd617a6e
Instruction Fuzzy Hash: 33219A35E00208EFCB10DFA8C941ACEBBF5AF45314F0441AAE804AB342DB76AF40DB95

Uniqueness

Uniqueness Score: -1.00%

Function 006E6F28, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 006E2774: GetModuleHandleA.KERNEL32(advapi32.dll,SetEntriesInAclA), ref: 006E279F
Part of subcall function 006E2774: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E2809
Part of subcall function 006E2774: InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000000,advapi32.dll,SetEntriesInAclA), ref: 006E28C8

GetCurrentProcessId.KERNEL32(?,00000000,006E6FAE,?,00000000), ref: 006E6F54

Part of subcall function 00411DA0: CreateMutexA.KERNEL32(?,00000001,00000000,?,006E6F89,?,00000000,00000000,?,00000000), ref: 00411DB6

WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,?,00000000,006E6FAE,?,00000000), ref: 006E6F8E

Strings

madExceptSettingsMtx, xrefs: 006E6F6B

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentProcess$CreateDescriptorHandleInitializeModuleMutexObjectSecuritySingleWait
String ID: madExceptSettingsMtx
API String ID: 4049993468-1171596302
Opcode ID: d1a2d0ccdf739eec20748dfd12491def31f0333a4ec86a6238c2036814cdf440
Instruction ID: 95a4aac3995b2927460bcdf95e82da48f280ffe88f3acc680ef78e637c52c52c
Opcode Fuzzy Hash: d1a2d0ccdf739eec20748dfd12491def31f0333a4ec86a6238c2036814cdf440
Instruction Fuzzy Hash: 66019E309042085FDB00EBA1D852ADEB7FEEB48310F514536F410F36D2EA389D408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00980CD0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00981504: LoadLibraryW.KERNEL32(kernel32.dll), ref: 0098151C
Part of subcall function 00981504: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process,kernel32.dll), ref: 00981545

LoadLibraryW.KERNEL32(kernel32.dll), ref: 00980CF5

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Strings

Wow64RevertWow64FsRedirection, xrefs: 00980D03
kernel32.dll, xrefs: 00980CF0

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCurrentProcProcess
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 84513099-1355242751
Opcode ID: 04ac78919b9aaa13fae302f87e66522c6950973b3ec418c9239850f2eec82271
Instruction ID: c097301664e86c623429817cbac86ff8f28c28dc3d7167ca42f3b18b673790b1
Opcode Fuzzy Hash: 04ac78919b9aaa13fae302f87e66522c6950973b3ec418c9239850f2eec82271
Instruction Fuzzy Hash: D1F0F970D51308ABCB50EFF4D84968DB7B8AB44314F10459AE454A33A1DB786A94DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00980C10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00981504: LoadLibraryW.KERNEL32(kernel32.dll), ref: 0098151C
Part of subcall function 00981504: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process,kernel32.dll), ref: 00981545

LoadLibraryW.KERNEL32(kernel32.dll), ref: 00980C35

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

Strings

kernel32.dll, xrefs: 00980C30
Wow64DisableWow64FsRedirection, xrefs: 00980C43

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCurrentProcProcess
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 84513099-3689287502
Opcode ID: a8b800d9e1a7ad1f90670266fce1c67da53f24e1cedf8f3bacb34e80e5bfefff
Instruction ID: e7a123fd125246bcf066bc6b1ae5d87b0fb5c34a736b828bb1b220611262ce87
Opcode Fuzzy Hash: a8b800d9e1a7ad1f90670266fce1c67da53f24e1cedf8f3bacb34e80e5bfefff
Instruction Fuzzy Hash: 60F03070D58308EFCB60EFF5C94979DB7B8AB48314F00869AA590E3390D7754694DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00980A4F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?), ref: 00980A64

Strings

FindFirstFile fail, xrefs: 00980A7F
FileExists64, xrefs: 00980A84

Memory Dump Source

Source File: 00000006.00000002.701046124.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.701037200.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702148490.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702155115.00000000009AD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702169044.00000000009AE000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702179539.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702190947.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702215582.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702228423.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702243827.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702259979.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702283161.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702303125.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702309578.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702329512.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702336107.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702344667.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702353548.00000000009DA000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702361029.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702369216.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702379832.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000006.00000002.702388760.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.702396499.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702403592.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702472347.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702576309.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.702642673.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CloseFind
String ID: FileExists64$FindFirstFile fail
API String ID: 1863332320-1578121874
Opcode ID: 87e42979507fe475a98de31e4b7912019de19448d7e62ac2392d43504a069fd8
Instruction ID: 27b208c456f6bb4553588649fc66a2b49118b8215db2a91cf7b542dfc51e709c
Opcode Fuzzy Hash: 87e42979507fe475a98de31e4b7912019de19448d7e62ac2392d43504a069fd8
Instruction Fuzzy Hash: C2F08235A053899ACF68E7E8C50DBAEBBB59B85304F1441E4986462390C2754F49DB52

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PCHelpSoftDriverUpdater.exe PID: 6664 Parent PID: 6364 PCHelpSoftDriverUpdater.exeCOMMON

Executed Functions

Function 0096C988, Relevance: 293.9, APIs: 30, Strings: 137, Instructions: 1695COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,?,00000000,0096E798), ref: 0096D052

Strings

HttpQueryInfo HTTP_QUERY_CONTENT_LENGTH fail: , xrefs: 0096DF04
t, xrefs: 0096CEFD
Continue previous downloading, Data.Size=, xrefs: 0096E016
, ERROR_INTERNET_CANNOT_CONNECT, xrefs: 0096D979
., xrefs: 0096CEAD
m, xrefs: 0096CFBD
r, xrefs: 0096CB23
InternetQueryOption 2 fail, xrefs: 0096D20F
Accept: */*, xrefs: 0096D29A
p, xrefs: 0096CB43
r, xrefs: 0096D5C8
a, xrefs: 0096CB93
d, xrefs: 0096CF4D
DataSize=, xrefs: 0096E682
., xrefs: 0096D648
d, xrefs: 0096CE7D
a, xrefs: 0096CB13
i, xrefs: 0096D608
i, xrefs: 0096CAA3
e, xrefs: 0096CA73
c, xrefs: 0096CBD3
407: disabling preconfig, xrefs: 0096DC52
o, xrefs: 0096CBE3
p, xrefs: 0096D5E8
, Data.Size=, xrefs: 0096E30B, 0096E47F
m, xrefs: 0096D668
InternetReadFile timeout final: , xrefs: 0096E2E3
u, xrefs: 0096D588
r, xrefs: 0096CAD3
%20, xrefs: 0096D0C5
o, xrefs: 0096D738
c, xrefs: 0096CA83
c, xrefs: 0096CB53
v, xrefs: 0096CAB3
b, xrefs: 0096D598
s, xrefs: 0096D708
Code , xrefs: 0096DD8C
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 0096CC0E
Status code fail: , xrefs: 0096DE18
, ServerError: , xrefs: 0096D9BC, 0096E32A
r, xrefs: 0096CEED
Cancelled 2: , xrefs: 0096E5D7
t, xrefs: 0096D6C8
e, xrefs: 0096CA93
l, xrefs: 0096D6F8
m, xrefs: 0096CB03
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 0096CFD8
u, xrefs: 0096CF2D
Path=, xrefs: 0096D15B
InternetReadFile fail 1: , xrefs: 0096E3C3
HttpOpenRequest timeout: , xrefs: 0096D113
InternetSetFilePointer fail 2, xrefs: 0096E284
i, xrefs: 0096D5D8
s, xrefs: 0096D638
o, xrefs: 0096D618
c, xrefs: 0096D6B8
e, xrefs: 0096CAC3
e, xrefs: 0096CF7D
p, xrefs: 0096CF3D
HttpSendRequest fail 2: , xrefs: 0096DA32
Status code fail 407 Proxy Authentication Required: , xrefs: 0096DCA9, 0096DD14
e, xrefs: 0096CE8D
m, xrefs: 0096D748
t, xrefs: 0096D5F8
Pragma: no-cache, xrefs: 0096D28D
HttpSendRequest fail 1: , xrefs: 0096D958
s, xrefs: 0096CEBD
InternetReadFile timeout first, Data.Size=, xrefs: 0096E182
94.130.13.99, xrefs: 0096CC2B, 0096CE58, 0096D777, 0096D7F0
m, xrefs: 0096CECD
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 0096CE3B, 0096D50C, 0096D763
, DataSize=, xrefs: 0096E2EE, 0096E462
s, xrefs: 0096D5A8
HttpSendRequest cannot connect, xrefs: 0096D8FD
d, xrefs: 0096CB83
r, xrefs: 0096CA63
e, xrefs: 0096CBB3
t, xrefs: 0096D698
, IP:, xrefs: 0096D11E, 0096D166, 0096D963, 0096D9D7, 0096DA3D, 0096DA96, 0096DB03, 0096E087, 0096E1A1, 0096E236, 0096E345, 0096E3CE, 0096E49E
XInternet.LoadInternetData, xrefs: 0096CA19, 0096D05D, 0096D14A, 0096D19C, 0096D214, 0096D27E, 0096D54B, 0096D7BF, 0096D860, 0096D8B2, 0096D902, 0096D994, 0096DA03, 0096DA6E, 0096DAC7, 0096DB48, 0096DBFC, 0096DC57, 0096DCE7, 0096DD52, 0096DDCA, 0096DE56, 0096DF25, 0096DF94, 0096E026, 0096E0BF, 0096E12A, 0096E1CD, 0096E289, 0096E38C, 0096E3FF, 0096E508, 0096E59B, 0096E5F8, 0096E702
r, xrefs: 0096D688
Data.Size=, xrefs: 0096E69F
v, xrefs: 0096CE9D
c, xrefs: 0096D5B8
HttpOpenRequest fail, xrefs: 0096D197
s, xrefs: 0096D578
Host=, xrefs: 0096D041, 0096D1F8, 0096D262
., xrefs: 0096CAE3
HttpSendRequest switch to ip (not resolved): , xrefs: 0096D52A, 0096D79E
Host: , xrefs: 0096D2D0
, ERROR_INTERNET_NAME_NOT_RESOLVED, xrefs: 0096DA53
c, xrefs: 0096CF9D
t, xrefs: 0096CB33
Connection: Keep-Alive, xrefs: 0096D2A7
p, xrefs: 0096CF0D
a, xrefs: 0096CF5D
Data.Size=, xrefs: 0096E068, 0096E217
InternetSetFilePointer fail 1, xrefs: 0096E0BA
DownloadingTest, xrefs: 0096E596
n, xrefs: 0096D628
., xrefs: 0096D718
HttpSendRequest fail 4: , xrefs: 0096DADD
o, xrefs: 0096D6E8
t, xrefs: 0096CF6D
c, xrefs: 0096CF1D
a, xrefs: 0096D678
InternetSetOption 2 fail, xrefs: 0096D279
fail: , xrefs: 0096DDA9
HttpSendRequest switch to http (ssl): , xrefs: 0096D826
Proxy-Connection: Keep-Alive, xrefs: 0096D2B4
Cancelled 1: , xrefs: 0096E109
s, xrefs: 0096D658
p, xrefs: 0096CB73
s, xrefs: 0096CAF3
InternetReadFile fail 2, xrefs: 0096E503
u, xrefs: 0096CB63
t, xrefs: 0096CBA3
Fail, xrefs: 0096E6FD
ConnectToInternet fail, xrefs: 0096D058
136.243.82.24, xrefs: 0096CFF5
c, xrefs: 0096D728
HttpSendRequest fail 3: , xrefs: 0096DA8B
, WinInetTimeout=, xrefs: 0096E24C, 0096E35B, 0096E4B4, 0096E6BE
., xrefs: 0096CF8D
o, xrefs: 0096D6D8
HttpQueryInfo HTTP_QUERY_STATUS_CODE fail: , xrefs: 0096DBDB
p, xrefs: 0096D6A8
Already downloaded: , xrefs: 0096DF73
}/, xrefs: 0096E3B2
, ERROR_INTERNET_SECURITY_CHANNEL_ERROR, xrefs: 0096DAAC, 0096E3E4
o, xrefs: 0096CFAD
a, xrefs: 0096CEDD
Not secure, xrefs: 0096CA14
., xrefs: 0096CBC3
HttpSendRequest timeout: , xrefs: 0096D9B1
HttpSendRequest timeout, xrefs: 0096D8AD
m, xrefs: 0096CBF3

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: Data.Size=$ fail: $%20$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$, Data.Size=$, DataSize=$, ERROR_INTERNET_CANNOT_CONNECT$, ERROR_INTERNET_NAME_NOT_RESOLVED$, ERROR_INTERNET_SECURITY_CHANNEL_ERROR$, IP:$, ServerError: $, WinInetTimeout=$.$.$.$.$.$.$136.243.82.24$407: disabling preconfig$94.130.13.99$Accept: */*$Already downloaded: $Cancelled 1: $Cancelled 2: $Code $ConnectToInternet fail$Connection: Keep-Alive$Continue previous downloading, Data.Size=$Data.Size=$DataSize=$DownloadingTest$Fail$Host: $Host=$HttpOpenRequest fail$HttpOpenRequest timeout: $HttpQueryInfo HTTP_QUERY_CONTENT_LENGTH fail: $HttpQueryInfo HTTP_QUERY_STATUS_CODE fail: $HttpSendRequest cannot connect$HttpSendRequest fail 1: $HttpSendRequest fail 2: $HttpSendRequest fail 3: $HttpSendRequest fail 4: $HttpSendRequest switch to http (ssl): $HttpSendRequest switch to ip (not resolved): $HttpSendRequest timeout$HttpSendRequest timeout: $InternetQueryOption 2 fail$InternetReadFile fail 1: $InternetReadFile fail 2$InternetReadFile timeout final: $InternetReadFile timeout first, Data.Size=$InternetSetFilePointer fail 1$InternetSetFilePointer fail 2$InternetSetOption 2 fail$Not secure$Path=$Pragma: no-cache$Proxy-Connection: Keep-Alive$Status code fail 407 Proxy Authentication Required: $Status code fail: $XInternet.LoadInternetData$a$a$a$a$a$b$c$c$c$c$c$c$c$c$d$d$d$e$e$e$e$e$e$i$i$i$l$m$m$m$m$m$m$n$o$o$o$o$o$o$p$p$p$p$p$p$r$r$r$r$r$r$s$s$s$s$s$s$s$t$t$t$t$t$t$t$u$u$u$v$v$}/
API String ID: 1452528299-1012387815
Opcode ID: 4d4820e869c34ad45b05532158a7721f2786c839663f1265361df1784dd9314a
Instruction ID: 000390f283cc8dbe46bcc683d4c7fb8fb59f7a229b838d1d37d05c36c3065bad
Opcode Fuzzy Hash: 4d4820e869c34ad45b05532158a7721f2786c839663f1265361df1784dd9314a
Instruction Fuzzy Hash: D5039D30904259DEDF20DB95DC49BEDBBB5AF54308F1040EAE1087B2A2D7B95E84CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0080E3A8, Relevance: 91.7, APIs: 36, Strings: 16, Instructions: 686encryptionCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,00000000,00001FFE,00000006,00000000,?,?,?,?,?,?), ref: 0080E462
GetLastError.KERNEL32(00000000,0080EC3F,?,00000000,0080EC64,?,?,00988675,00000000,00988728,?,00000000,00988765,?,00000000,00000000), ref: 0080E46B
GetLastError.KERNEL32(00000000,0080EC3F,?,00000000,0080EC64,?,?,00988675,00000000,00988728,?,00000000,00988765,?,00000000,00000000), ref: 0080E477
CryptMsgGetParam.CRYPT32(?,00000005,00000000,00000000,?), ref: 0080E4C8
GetLastError.KERNEL32(00000000,0080EC3F,?,00000000,0080EC64,?,?,00988675,00000000,00988728,?,00000000,00988765,?,00000000,00000000), ref: 0080E4D1
CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 0080E517
GetLastError.KERNEL32(?,00000005,00000000,?,?,00000000,0080EC3F,?,00000000,0080EC64,?,?,00988675,00000000,00988728), ref: 0080E520

Strings

CryptQueryObject fail, xrefs: 0080E480, 0080E957
CryptMsgGetParam 5 fail, xrefs: 0080E64F
CertFindCertificateInStore 2 fail, xrefs: 0080EA7D
1.2.840.113549.1.9.1, xrefs: 0080E7B7, 0080EB22
CryptMsgGetParam 7 fail, xrefs: 0080E98B
CryptMsgGetParam 4 fail, xrefs: 0080E610
GetSignaturesInfo, xrefs: 0080E485, 0080E4DF, 0080E52E, 0080E5C0, 0080E615, 0080E654, 0080E6A9, 0080E717, 0080E923, 0080E95C, 0080E990, 0080E9DA, 0080EA14, 0080EA82
CertFindCertificateInStore 1 fail, xrefs: 0080E712
CryptMsgGetParam 1 fail, xrefs: 0080E4DA
CryptMsgGetParam 2 fail, xrefs: 0080E529
1.3.6.1.4.1.311.2.4.1, xrefs: 0080E858
CertOpenStore fail, xrefs: 0080EA0F
CryptMsgOpenToDecode fail, xrefs: 0080E91E
CryptMsgGetParam 3 fail, xrefs: 0080E5BB
CryptMsgGetParam 8 fail, xrefs: 0080E9D5
CryptMsgGetParam 6 fail, xrefs: 0080E6A4

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$Crypt$Param$ObjectQuery
String ID: 1.2.840.113549.1.9.1$1.3.6.1.4.1.311.2.4.1$CertFindCertificateInStore 1 fail$CertFindCertificateInStore 2 fail$CertOpenStore fail$CryptMsgGetParam 1 fail$CryptMsgGetParam 2 fail$CryptMsgGetParam 3 fail$CryptMsgGetParam 4 fail$CryptMsgGetParam 5 fail$CryptMsgGetParam 6 fail$CryptMsgGetParam 7 fail$CryptMsgGetParam 8 fail$CryptMsgOpenToDecode fail$CryptQueryObject fail$GetSignaturesInfo
API String ID: 2905775066-2327634912
Opcode ID: cf919d9984a563bd06070490a3498df089df736e07ef6513d23983ff75390918
Instruction ID: f30c40c5762d9ad9e2f8efdf8631136b16af2e6c336e71f33b5db1ad09e88dd4
Opcode Fuzzy Hash: cf919d9984a563bd06070490a3498df089df736e07ef6513d23983ff75390918
Instruction Fuzzy Hash: 9E423E71A041099FDB54EFA9CC45BAFB7B9FF48304F10886AF605F7286DA35A940CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0097D888, Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 225COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0097D894
OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 0097D89A
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0097D8B2
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000001,?,00000000,00000028,?), ref: 0097D8E9
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,00000028,?), ref: 0097D8F4
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,00000028,?), ref: 0097D916
GetLastError.KERNEL32(00000000,00000000,00000028,?), ref: 0097D934
LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 0097D959
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000001,?,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097D990
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097D99B
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097D9BD
GetLastError.KERNEL32(00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097D9DB
LookupPrivilegeValueW.ADVAPI32(00000000,SeImpersonatePrivilege,?), ref: 0097DA00
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000001,?,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000), ref: 0097DA37
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000), ref: 0097DA42
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000), ref: 0097DA64
GetLastError.KERNEL32(00000000,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000,00000000,00000028,?), ref: 0097DA82
LookupPrivilegeValueW.ADVAPI32(00000000,SeLoadDriverPrivilege,?), ref: 0097DAA7
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000001,?,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000,00000000), ref: 0097DADE
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000), ref: 0097DAE9
GetLastError.KERNEL32(00000000,?,00000000,00000001,00000010,00000001,?,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000), ref: 0097DB0B
GetLastError.KERNEL32(00000000,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?,00000000,00000000), ref: 0097DB29
CloseHandle.KERNEL32(?,00000000,00000000,00000000,SeLoadDriverPrivilege,?,00000000,00000000,00000000,SeImpersonatePrivilege,?,00000000,00000000,00000000,SeIncreaseQuotaPrivilege,?), ref: 0097DB47
GetLastError.KERNEL32(00000000,00000000,00000028,?), ref: 0097DB50

Strings

SeDebugPrivilege, xrefs: 0097D8AB
SeIncreaseQuotaPrivilege, xrefs: 0097D952
AdjustTokenPrivileges 1.2 fail, xrefs: 0097D91C
SeImpersonatePrivilege, xrefs: 0097D9F9
LookupPrivilegeValue 4 fail, xrefs: 0097DA88, 0097DB2F
AdjustTokenPrivileges 1.1 fail, xrefs: 0097D8FA
AdjustTokenPrivileges 4.2 fail, xrefs: 0097DB11
OpenProcessToken fail, xrefs: 0097DB56
XSettings.GetDebugPrivilege, xrefs: 0097D8FF, 0097D921, 0097D93F, 0097D9A6, 0097D9C8, 0097D9E6, 0097DA4D, 0097DA6F, 0097DA8D, 0097DAF4, 0097DB16, 0097DB34, 0097DB5B
LookupPrivilegeValue 2 fail, xrefs: 0097D9E1
SeLoadDriverPrivilege, xrefs: 0097DAA0
AdjustTokenPrivileges 2.2 fail, xrefs: 0097D9C3
AdjustTokenPrivileges 2.1 fail, xrefs: 0097D9A1
AdjustTokenPrivileges 4.1 fail, xrefs: 0097DAEF
LookupPrivilegeValue fail, xrefs: 0097D93A
AdjustTokenPrivileges 3.1 fail, xrefs: 0097DA48
AdjustTokenPrivileges 3.2 fail, xrefs: 0097DA6A

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$Token$AdjustLookupPrivilegePrivilegesValue$Process$CloseCurrentHandleOpen
String ID: AdjustTokenPrivileges 1.1 fail$AdjustTokenPrivileges 1.2 fail$AdjustTokenPrivileges 2.1 fail$AdjustTokenPrivileges 2.2 fail$AdjustTokenPrivileges 3.1 fail$AdjustTokenPrivileges 3.2 fail$AdjustTokenPrivileges 4.1 fail$AdjustTokenPrivileges 4.2 fail$LookupPrivilegeValue 2 fail$LookupPrivilegeValue 4 fail$LookupPrivilegeValue fail$OpenProcessToken fail$SeDebugPrivilege$SeImpersonatePrivilege$SeIncreaseQuotaPrivilege$SeLoadDriverPrivilege$XSettings.GetDebugPrivilege
API String ID: 1726988503-222983939
Opcode ID: 940a83c1dea832c9cffcf069592a01d2d121b2f299ca421ff597b7d606ab3056
Instruction ID: 2c92ae18ce93c77aa583537f7ae2e6435f65f1c5da883f68776054932c41ebcb
Opcode Fuzzy Hash: 940a83c1dea832c9cffcf069592a01d2d121b2f299ca421ff597b7d606ab3056
Instruction Fuzzy Hash: 2B814D72A06209ABDB50EB94C942FEE77FCAF48704F108125F609F7682D7B4DE409765

Uniqueness

Uniqueness Score: -1.00%

Function 0075A27C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,00000004,?,00000000,0075A347,?,?,?), ref: 0075A2DA
GetLastError.KERNEL32(?,?,?), ref: 0075A2E0
GetLastError.KERNEL32(?,?,00000000,?,?,?), ref: 0075A30D

Strings

ReadRegistryDwordProperty, xrefs: 0075A318
PropertyIndex=, xrefs: 0075A2FF
SetupDiGetDeviceRegistryProperty fail, xrefs: 0075A313

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$DevicePropertyRegistrySetup
String ID: PropertyIndex=$ReadRegistryDwordProperty$SetupDiGetDeviceRegistryProperty fail
API String ID: 3039287030-2170811707
Opcode ID: 44d7cb9fc73bb7230bad30135c7e9c9c1d39a6711a24e054cfefc3faf4706b01
Instruction ID: 55ccd91905673264b416b00f04d425d597a98082997ad53d242d7d56735aadd6
Opcode Fuzzy Hash: 44d7cb9fc73bb7230bad30135c7e9c9c1d39a6711a24e054cfefc3faf4706b01
Instruction Fuzzy Hash: F32128B6A00208BFCB05DFA9DC80DEEBBF9FB48304F51457AB904E3250D6789A048B65

Uniqueness

Uniqueness Score: -1.00%

Function 0097D114, Relevance: 9.1, APIs: 6, Instructions: 111nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,00000000,0097D23C), ref: 0097D170
NtQueryInformationProcess.NTDLL(00000000,00000000,?,00000018,?), ref: 0097D192
ReadProcessMemory.KERNEL32(00000000,?,?,000001D8,?,00000410,00000000,00000000,00000000,0097D23C), ref: 0097D1B7
ReadProcessMemory.KERNEL32(00000000,?,?,00000290,?,00000000,?,?,000001D8,?,00000410,00000000,00000000,00000000,0097D23C), ref: 0097D1DB
ReadProcessMemory.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,00000290,?,00000000,?,?,000001D8,?,00000410), ref: 0097D215
CloseHandle.KERNEL32(00000000,00000410,00000000,00000000,00000000,0097D23C), ref: 0097D22D

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Process$MemoryRead$CloseHandleInformationOpenQuery
String ID:
API String ID: 452587172-0
Opcode ID: 5126462ac34db7c7ce4787e35d2e00aa6690fecfe66654c085759cf235516dc3
Instruction ID: a242eed67a7fc56fbcd161cbf9b460dea7e9f6109ad705df05e685290ec95dc0
Opcode Fuzzy Hash: 5126462ac34db7c7ce4787e35d2e00aa6690fecfe66654c085759cf235516dc3
Instruction Fuzzy Hash: D9413FB1A00219AEDB50DBA5DC41FEEB7FCEF08704F5044AAB618E2181E674AE41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 007982D8, Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

CreateBindCtx.OLE32(00000000,00000000), ref: 00798305
MkParseDisplayName.OLE32(?,00000000,00000000,00000000), ref: 00798329

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: BindCreateDisplayNameParse
String ID:
API String ID: 3124428456-0
Opcode ID: d0d77f50e1e76a1b188c350b4d95097944245c5f800f5fda8f67ce4f067a645b
Instruction ID: b1e8dd1a81efda29bb1cd8cb5fee349299a2ebc5e81b290252a9ba307f465ba2
Opcode Fuzzy Hash: d0d77f50e1e76a1b188c350b4d95097944245c5f800f5fda8f67ce4f067a645b
Instruction Fuzzy Hash: EA11FE71D04248AFCB40EBAADC42DAEB7BCEF09704F4045BAB419E2291DB795E058A59

Uniqueness

Uniqueness Score: -1.00%

Function 00422428, Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,?,00000000,004C81B5,?,00000000,004C830A,?,?,00000000), ref: 00422443
GetLastError.KERNEL32(00000000,?,00000000,?,00000000,004C81B5,?,00000000,004C830A,?,?,00000000), ref: 00422468

Part of subcall function 0042238C: FileTimeToLocalFileTime.KERNEL32(?), ref: 004223C4
Part of subcall function 0042238C: FileTimeToDosDateTime.KERNEL32 ref: 004223E3

Part of subcall function 0042249C: FindClose.KERNEL32(?,?,00422466,00000000,?,00000000,?,00000000,004C81B5,?,00000000,004C830A,?,?,00000000), ref: 004224A8

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileTime$Find$CloseDateErrorFirstLastLocal
String ID:
API String ID: 976985129-0
Opcode ID: 4f7ff111f6f5c81d4b71c3a6d81efaa69b2ee28b3006598b6a7c9de3256b06c2
Instruction ID: 9c22e394053623b93aedd380e82471f09ee57f69d3da43d182795a2d321c5cd4
Opcode Fuzzy Hash: 4f7ff111f6f5c81d4b71c3a6d81efaa69b2ee28b3006598b6a7c9de3256b06c2
Instruction Fuzzy Hash: F7E0ED72B01230274314BA7E69814AA61884A8876434A037FBE05EB346D96CCD1A5BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040D838, Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040D896,?,00000001), ref: 0040D86B
FindClose.KERNEL32(00000000,00000000,?,00000000,0040D896,?,00000001), ref: 0040D87B

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 503b068a5e25caa2ef2d9a8afba26745935dc7f8a4317aa1ffb9d167a2b934a3
Instruction ID: 9f0b7f41a0254bfe0e0b0bd36dab9945d52636fdc0296f32eb456b68b1d7e2f6
Opcode Fuzzy Hash: 503b068a5e25caa2ef2d9a8afba26745935dc7f8a4317aa1ffb9d167a2b934a3
Instruction Fuzzy Hash: 64F0E272900604AFD710FBB5DD0298EB3ACEB44310BA105B7F814F26D1E7389F14A55C

Uniqueness

Uniqueness Score: -1.00%

Function 0083E460, Relevance: 72.7, APIs: 2, Strings: 46, Instructions: 654COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,.status,?,?,.status,?,?,00000000,0083ED1B,?,00000000,00000000,00000000,?,?,0083F499), ref: 0083E542
GetLastError.KERNEL32(?), ref: 0083E67F

Part of subcall function 0097D3A4: GetTickCount.KERNEL32 ref: 0097D3CB

Part of subcall function 00424AF0: GetLocalTime.KERNEL32(?), ref: 00424AF8

Strings

Date1, xrefs: 0083EBA0
IsUnfiltered, xrefs: 0083E8DF
Size, xrefs: 0083EA9C
ClassName, xrefs: 0083E8FE
PackageName, xrefs: 0083E9D7
IsNewSystem, xrefs: 0083E939
DeviceDescription, xrefs: 0083EAE6
Wrong installer 2 for , xrefs: 0083EA5C
.inf, xrefs: 0083E97F
Pending, xrefs: 0083E5EB
CheckAfterRestart, xrefs: 0083E5CC
Status, xrefs: 0083E56B
Version1, xrefs: 0083EBE2
-scan, xrefs: 0083E766, 0083E784
Downloaded, xrefs: 0083E600, 0083E629
TDriversList.Scan, xrefs: 0083E54D, 0083E5A4, 0083E68A, 0083EA35, 0083EA6C
IsFailed, xrefs: 0083E8C7
Version2, xrefs: 0083EBF8
Installer, xrefs: 0083E96A
Description, xrefs: 0083EC3A
DeviceName, xrefs: 0083EC66
IsConnected, xrefs: 0083E8AF
Vendor, xrefs: 0083EBCC
Wrong installer 1 for , xrefs: 0083EA25
Class, xrefs: 0083EC0E
FName, xrefs: 0083EB8A
.msi, xrefs: 0083E9B1, 0083E9FF
.exe, xrefs: 0083E99E, 0083E9EC
Group, xrefs: 0083EB74
Installed, xrefs: 0083E5B8
Md5Hash, xrefs: 0083EC50
Present, xrefs: 0083E64D
ClassGUID, xrefs: 0083EC24
Status file not found, xrefs: 0083E59F
TryOpenIniFile failed, xrefs: 0083E685
IsPending, xrefs: 0083E82D, 0083E84A
DeviceID, xrefs: 0083EB50
Winner, xrefs: 0083E7B8
TryOpenIniFile fail, xrefs: 0083E548
.status, xrefs: 0083E4E6, 0083E526, 0083E589
-drv-, xrefs: 0083E7AA
Generated, xrefs: 0083E6A2
Settings, xrefs: 0083E570, 0083E5D1, 0083E62E, 0083E652, 0083E6A7
IsSystemDriver, xrefs: 0083E921
DriverID, xrefs: 0083EA84
Date2, xrefs: 0083EBB6

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$CountLocalTickTime
String ID: -drv-$-scan$.exe$.inf$.msi$.status$CheckAfterRestart$Class$ClassGUID$ClassName$Date1$Date2$Description$DeviceDescription$DeviceID$DeviceName$Downloaded$DriverID$FName$Generated$Group$Installed$Installer$IsConnected$IsFailed$IsNewSystem$IsPending$IsSystemDriver$IsUnfiltered$Md5Hash$PackageName$Pending$Present$Settings$Size$Status$Status file not found$TDriversList.Scan$TryOpenIniFile fail$TryOpenIniFile failed$Vendor$Version1$Version2$Winner$Wrong installer 1 for $Wrong installer 2 for
API String ID: 886200623-270073040
Opcode ID: f3c80ff7d537327fd1bf52261eb50071f1d4f8d82e032a28e0090799d5d2675e
Instruction ID: 5e7fe13f7718b801e8196870723a3ee144f500072daaeee2be8ad02ffd173366
Opcode Fuzzy Hash: f3c80ff7d537327fd1bf52261eb50071f1d4f8d82e032a28e0090799d5d2675e
Instruction Fuzzy Hash: 17522A74A002599FDB10DB94C981BDEB7B5FF88304F1084A5EA05EB396CB74AD49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009AA254, Relevance: 63.4, APIs: 17, Strings: 19, Instructions: 350COMMON

Download Yara Rule

Strings

PCHelpSoftDriverUpdater, xrefs: 009AA828, 009AA94C, 009AA961
/OPTIONS, xrefs: 009AA462
/OPENREGURL, xrefs: 009AA355
/REPAIR, xrefs: 009AA8CA
mm-dd-yyyy, xrefs: 009AA6FD
/UNINSTALLMAN, xrefs: 009AA556
InstallationDate, xrefs: 009AA736
SOFTWARE\PC HelpSoft Driver Updater, xrefs: 009AA73B
PC HelpSoft Driver Updater, xrefs: 009AA60D
/JUSTSCA, xrefs: 009AA8EF
/DRIVER, xrefs: 009AA89E
/CHECKINSTALL, xrefs: 009AA5D0
/INSTALL, xrefs: 009AA69E
/uninstall, xrefs: 009AA29E
/CHECKSUB, xrefs: 009AA3A2
/COLLECT, xrefs: 009AA404
/CHECKUPDATE, xrefs: 009AA2F1
/STARTMAN, xrefs: 009AA4DC
/RESTART, xrefs: 009AA815

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID:
String ID: /CHECKINSTALL$/CHECKSUB$/CHECKUPDATE$/COLLECT$/DRIVER$/INSTALL$/JUSTSCA$/OPENREGURL$/OPTIONS$/REPAIR$/RESTART$/STARTMAN$/UNINSTALLMAN$/uninstall$InstallationDate$PC HelpSoft Driver Updater$PCHelpSoftDriverUpdater$SOFTWARE\PC HelpSoft Driver Updater$mm-dd-yyyy
API String ID: 0-2328019585
Opcode ID: a3c4cf26d431c110d8f17cec37fd9509adc903d6633f49737ea487be8fac96e9
Instruction ID: 26b39a550285db20f71faa19560ebd98f125139ba8096f26770a2237b0884562
Opcode Fuzzy Hash: a3c4cf26d431c110d8f17cec37fd9509adc903d6633f49737ea487be8fac96e9
Instruction Fuzzy Hash: 65E19331B952049FD711EB69DC41FAE37E5EB8A314F404066F5009B3A2CB789C90DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0075541C, Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 445COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3(?,00000000,000000FF,?,?,00000000,007559BA,?,00000000,007559DC), ref: 00755495
sqlite3_step.SQLITE3(00000000,?,00000000,007559DC), ref: 007554CB
sqlite3_column_count.SQLITE3(00000000,?,00000000,007559DC), ref: 00755543
sqlite3_column_name.SQLITE3(00000000,00000000,?,00000000,007559DC), ref: 00755588
sqlite3_column_decltype.SQLITE3(00000000,00000000,?,00000000,007559DC), ref: 007555F1
sqlite3_column_type.SQLITE3(00000000,00000000,?,?,?,00000000,007559DC), ref: 0075560A
sqlite3_column_type.SQLITE3(00000000,00000000,?,00000000,007559DC), ref: 0075575C
sqlite3_column_int.SQLITE3(00000000,00000000,?,?,?,00000000,007559DC), ref: 007557A7
sqlite3_column_int.SQLITE3(00000000,00000000,?,?,?,00000000,007559DC), ref: 007557EF
sqlite3_column_double.SQLITE3(00000000,00000000,?,?,?,00000000,007559DC), ref: 0075583E
sqlite3_step.SQLITE3(00000000,00000001,?,?,00000000,007559DC), ref: 00755981
sqlite3_finalize.SQLITE3(00000000,007559C1), ref: 007559B3

Strings

Could not retrieve data, xrefs: 00755970
BLOB, xrefs: 007556DE
INTEGER, xrefs: 00755635
DOUBLE, xrefs: 007556B9
SQLite is Busy, xrefs: 00755943
e, xrefs: 0075598A
BOOLEAN, xrefs: 0075565D
FLOAT, xrefs: 0075569F
NUMERIC, xrefs: 00755685
Could not prepare SQL statement, xrefs: 007554BA, 00755955
Error executing SQL, xrefs: 007554A4

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: sqlite3_column_intsqlite3_column_typesqlite3_step$sqlite3_column_countsqlite3_column_decltypesqlite3_column_doublesqlite3_column_namesqlite3_finalizesqlite3_prepare
String ID: BLOB$BOOLEAN$Could not prepare SQL statement$Could not retrieve data$DOUBLE$Error executing SQL$FLOAT$INTEGER$NUMERIC$SQLite is Busy$e
API String ID: 2931358236-198153785
Opcode ID: dabc19d9c340ed9907a92b2c50ab89fea8c4759fa3a1c6dcdc8012d9226ab7ea
Instruction ID: 556126de3d30d91021183557a6c7b4eafe5f81af615ccf63207ecfa1b4df2cb2
Opcode Fuzzy Hash: dabc19d9c340ed9907a92b2c50ab89fea8c4759fa3a1c6dcdc8012d9226ab7ea
Instruction Fuzzy Hash: 7D021370E00608DFCB00EFA9D895ADEBBF5BF08315F218069E814AB361D779AD498B55

Uniqueness

Uniqueness Score: -1.00%

Function 0097174C, Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 200filenetworkCOMMON

Download Yara Rule

APIs

IcmpCreateFile.IPHLPAPI ref: 009717A3
GetLastError.KERNEL32(00000000,00000000,00971A47,?,?,00987FCF), ref: 009717B3
WSAStartup.WSOCK32(00000101,?,00000000,00971A47,?,?,00987FCF), ref: 00971803
GetLastError.KERNEL32(?,00000000,00000000,00000101,?,00000000), ref: 00971833
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00971851

Strings

XInternet.PingHost, xrefs: 009717BE, 0097183E, 0097190F, 0097193E
IcmpCreateFile fail, xrefs: 009717B9
IcmpSendEcho fail, xrefs: 00971939
IcmpSendEcho timeout for , xrefs: 009718FF
WSAStartup fail, xrefs: 00971839

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorIcmpLast$CloseCreateFileHandleStartup
String ID: IcmpCreateFile fail$IcmpSendEcho fail$IcmpSendEcho timeout for $WSAStartup fail$XInternet.PingHost
API String ID: 1017700833-2737738847
Opcode ID: 19df79da9068a4967165dd0bf9ac79461d01a5c7c8b96b3e13c3aa33bb1f0f86
Instruction ID: 40a597fc889a187608018f6e0ff60e42327cd7ff997cdd9f0dcbc3cc69ec6ef4
Opcode Fuzzy Hash: 19df79da9068a4967165dd0bf9ac79461d01a5c7c8b96b3e13c3aa33bb1f0f86
Instruction Fuzzy Hash: 49811AB1E00219DFCB14EF99C845AEEB7B4EF48304F0085AAE118E7651D7789E81DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00981008, Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 157filesleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 0098105D
CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00981098
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 009810BD
Sleep.KERNEL32(000007D0,00000000,80000000,00000001,00000000,00000003,00000080), ref: 009810D4
CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000004,00000080,00000000,000007D0,00000000,80000000,00000001,00000000,00000003,00000080), ref: 009810FA
GetLastError.KERNEL32(?,00000000,80000000,00000001,00000000,00000003,00000080,00000000,000007D0,00000000,80000000,00000001,00000000,00000003,00000080), ref: 00981131

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000007D0,00000000,80000000,00000001,00000000,00000003,00000080), ref: 0098111F
WriteFile.KERNEL32(000000FF,009D06B0,00000002,00000080,00000000,00000000,80000000,00000001,00000000,00000003,00000080), ref: 00981167
GetLastError.KERNEL32(?,000000FF,009D06B0,00000002,00000080,00000000,00000000,80000000,00000001,00000000,00000003,00000080), ref: 00981174
SetEndOfFile.KERNEL32(000000FF,000000FF,009D06B0,00000002,00000080,00000000,00000000,80000000,00000001,00000000,00000003,00000080), ref: 00981192
GetLastError.KERNEL32(?,000000FF,000000FF,009D06B0,00000002,00000080,00000000,00000000,80000000,00000001,00000000,00000003,00000080), ref: 0098119F
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,80000000,00000001,00000000,00000003,00000080), ref: 009811C9
GetLastError.KERNEL32(?,000000FF,00000000,00000000,00000002,00000000,80000000,00000001,00000000,00000003,00000080), ref: 009811D7

Strings

SetFilePointer fail, xrefs: 009811DD
XFile.AssignFileW, xrefs: 00981068, 0098113C, 0098117F, 009811AA, 009811E2
SetEndOfFile fail, xrefs: 009811A5
WriteFile fail, xrefs: 0098117A
DeleteFile fail, xrefs: 00981063
CreateFileW fail, xrefs: 00981137

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$ErrorLast$Create$AttributesPointerSleepWrite
String ID: CreateFileW fail$DeleteFile fail$SetEndOfFile fail$SetFilePointer fail$WriteFile fail$XFile.AssignFileW
API String ID: 130721769-3356998030
Opcode ID: 83035f0bd0e4694e37f7c3e710f7d8d3da4f2cf1316507f0d205c32e95a58b4a
Instruction ID: 4354d27e97fdb2364ffda9e130217ac5b73e55e40212b9080faabd9acfe8ea2b
Opcode Fuzzy Hash: 83035f0bd0e4694e37f7c3e710f7d8d3da4f2cf1316507f0d205c32e95a58b4a
Instruction Fuzzy Hash: 0F519070B04344BAEB20FBE48D46F9E77AC9B04754F104559B211FB3D2C6B8AE82A758

Uniqueness

Uniqueness Score: -1.00%

Function 0040D45C, Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D681,?,?), ref: 0040D495
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D681,?,?), ref: 0040D4DE
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D681,?,?), ref: 0040D500
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040D51E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040D53C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040D55A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040D578
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040D664,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D681), ref: 0040D5B8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040D664,?,80000001), ref: 0040D5E3
RegCloseKey.ADVAPI32(?,0040D66B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040D664,?,80000001,Software\Embarcadero\Locales), ref: 0040D65E

Strings

Software\Borland\Locales, xrefs: 0040D550
Software\Embarcadero\Locales, xrefs: 0040D4D4, 0040D4F6
Software\Borland\Delphi\Locales, xrefs: 0040D56E
Software\CodeGear\Locales, xrefs: 0040D514, 0040D532

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 38422511e293e455d82599edf3ace26ddf343796c7f78a471dcbb33ad021a8a9
Instruction ID: cb5fee359e33c40f42da520f887eb1c8d7238ca8925a212f965412b586eb314d
Opcode Fuzzy Hash: 38422511e293e455d82599edf3ace26ddf343796c7f78a471dcbb33ad021a8a9
Instruction Fuzzy Hash: 72512475E4020CBEEB10EAE5CC42FAE73ACDB48704F610476BA14F61C1D678AA549A5D

Uniqueness

Uniqueness Score: -1.00%

Function 0084A498, Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 162COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0084A4B4
GetTickCount.KERNEL32 ref: 0084A4EA

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

Strings

InitAndScanResultFrame, xrefs: 0084A4D6, 0084A5CF
FailSpace, xrefs: 0084A619
%Fo, xrefs: 0084A4EF
Scan just started, xrefs: 0084A4D1
Glo-11-update-noinet, xrefs: 0084A676
11-update-noinet, xrefs: 0084A680
Updating, xrefs: 0084A5CA
Glo-10-update-noinet, xrefs: 0084A64D
Drivers_new.db, xrefs: 0084A507
Engine, xrefs: 0084A61E
10-update-noinet, xrefs: 0084A657
Unfortunately, your computer does not have enough available disk space to complete this operation. Please free up some disk space, xrefs: 0084A609

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CountTick$AttributesFile
String ID: %Fo$10-update-noinet$11-update-noinet$Drivers_new.db$Engine$FailSpace$Glo-10-update-noinet$Glo-11-update-noinet$InitAndScanResultFrame$Scan just started$Unfortunately, your computer does not have enough available disk space to complete this operation. Please free up some disk space$Updating
API String ID: 3143076460-3508256238
Opcode ID: 4e78bf55e9fdc1463c322cea72c965f4fbf3a9e1521fac8515c2a88c7e0579e8
Instruction ID: 5869aae7b061ac4260c67e644a4a9308b2b0b7655bd67ba3d9bc7c9790a9feb8
Opcode Fuzzy Hash: 4e78bf55e9fdc1463c322cea72c965f4fbf3a9e1521fac8515c2a88c7e0579e8
Instruction Fuzzy Hash: 0951A0346992089FD708EF58C981BA937F5FB4A304F514066F600DF3A2CA39ED449B13

Uniqueness

Uniqueness Score: -1.00%

Function 0097F1AC, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 160timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B,?,?,00000000), ref: 0097F1F2
GetLastError.KERNEL32(00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B,?,?,00000000), ref: 0097F200
GetProcessTimes.KERNEL32(00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B,?,?,00000000), ref: 0097F26C
GetLastError.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B), ref: 0097F288
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B,?,?), ref: 0097F2B3
FileTimeToLocalFileTime.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000,0097F36B), ref: 0097F2C0
GetLastError.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346,?,00000000), ref: 0097F2D0

Part of subcall function 00976CF8: GetLastError.KERNEL32(?,?,00000000), ref: 00976D50

FileTimeToSystemTime.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346), ref: 0097F2FC
GetLastError.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,?,?,?,00000410,00000000,?,00000000,0097F346), ref: 0097F30C

Strings

FileTimeToSystemTime fail, xrefs: 0097F312
XProcess.GetProcessStartTime, xrefs: 0097F23C, 0097F293, 0097F2DB, 0097F317
FileTimeToLocalFileTime fail, xrefs: 0097F2D6
GetProcessTimes fail, xrefs: 0097F28E
OpenProcess fail, xrefs: 0097F237

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$Time$File$Process$CloseHandleLocalOpenSystemTimes
String ID: FileTimeToLocalFileTime fail$FileTimeToSystemTime fail$GetProcessTimes fail$OpenProcess fail$XProcess.GetProcessStartTime
API String ID: 1941282559-3664409035
Opcode ID: 47f450230a039d29e43b1adf33b29391d2818fe9bb812672500e1fd4e5d43b5c
Instruction ID: a28d9122cd8be31b0b20070e31157dc20af68181f26803e3dcdf25940512e78a
Opcode Fuzzy Hash: 47f450230a039d29e43b1adf33b29391d2818fe9bb812672500e1fd4e5d43b5c
Instruction Fuzzy Hash: 325181B29042089FDB14EBE4D861AAEB7FCFB88700F51843AF119F7651EA749D01CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0080B858, Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 256COMMON

Download Yara Rule

Strings

016-client-not-allowed-connection, xrefs: 0080BA14
IsAllowCollect, xrefs: 0080B88B, 0080B8B1, 0080BB35
SOFTWARE\Licenses\2419e59e6794f00ecf890f46b0866678, xrefs: 0080B940
014-client-not-allowed-obsolete, xrefs: 0080B980
Unknown NetworkCostType, xrefs: 0080BB30
Scan, xrefs: 0080B990, 0080B9AD
Obsolete, xrefs: 0080B955, 0080B966
Unsupported, xrefs: 0080B8AC
015-client-not-allowed-scan, xrefs: 0080B9CB
Not admin, xrefs: 0080B886
013-client-not-allowed-prerelease, xrefs: 0080B8E4
017-client-not-allowed-metered, xrefs: 0080BAB9

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLastVersion
String ID: 013-client-not-allowed-prerelease$014-client-not-allowed-obsolete$015-client-not-allowed-scan$016-client-not-allowed-connection$017-client-not-allowed-metered$IsAllowCollect$Not admin$Obsolete$SOFTWARE\Licenses\2419e59e6794f00ecf890f46b0866678$Scan$Unknown NetworkCostType$Unsupported
API String ID: 305913169-662349415
Opcode ID: d3d8cd961edac954cb9f57bb85276cb2c2e7dd335f41a7904d6db7a05db9f702
Instruction ID: ab245ec42d9c8352449b49cc6c1241b326f0641c74c2f7dcee14c60e7a99f870
Opcode Fuzzy Hash: d3d8cd961edac954cb9f57bb85276cb2c2e7dd335f41a7904d6db7a05db9f702
Instruction Fuzzy Hash: 7D916D31A041489FDB80EBA9CC46BADBBB4FF05318F4040AAE550E72E6DB399D4DC719

Uniqueness

Uniqueness Score: -1.00%

Function 0098E3E0, Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,0000020A), ref: 0098E513
GetWindowsDirectoryW.KERNEL32(?,0000020A,?,0000020A,00000000,0098E78F,?,?,00000000,00000000,?,?,007B4F01,?,00000000,007B505F), ref: 0098E55B
QueryDosDeviceW.KERNEL32(00000000,?,00000104,?,0000020A,?,0000020A,00000000,0098E78F,?,?,00000000,00000000,?,?,007B4F01), ref: 0098E5EA
GetLastError.KERNEL32(02A0E92C,00000000,?,00000104,?,0000020A,?,0000020A,00000000,0098E78F,?,?,00000000,00000000,?), ref: 0098E685

Strings

NewDB, xrefs: 0098E6D0, 0098E6E1
SOFTWARE\PC HelpSoft Driver Updater, xrefs: 0098E6BB
InitParams, xrefs: 0098E690
OldDB, xrefs: 0098E70C, 0098E71D
mm-dd-yyyy, xrefs: 0098E4F2
QueryDosDevice fail, xrefs: 0098E68B

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Directory$DeviceErrorLastQuerySystemWindows
String ID: InitParams$NewDB$OldDB$QueryDosDevice fail$SOFTWARE\PC HelpSoft Driver Updater$mm-dd-yyyy
API String ID: 2226724641-3255885571
Opcode ID: adfdf9d304700945ff03b8e692c8df90e6d4ff36df259946a9f1757dfae167b9
Instruction ID: a9057dfb9e13149ae0d44a61b00be343ad5337c88945e9ac3f88ed80a0355383
Opcode Fuzzy Hash: adfdf9d304700945ff03b8e692c8df90e6d4ff36df259946a9f1757dfae167b9
Instruction Fuzzy Hash: 61A1BF34A45209DFCB10FB55CC91A9D77BAEF45304F5080ABE404AB3A2DB38AE81DF59

Uniqueness

Uniqueness Score: -1.00%

Function 005D1584, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 168libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,00000000,005D17B6), ref: 005D1634
GetLastError.KERNEL32(00000000,00000000,005D17B6), ref: 005D16AE
GetLastError.KERNEL32(00000000,00000000,005D17B6), ref: 005D16BA
GetLastError.KERNEL32(00000000,00000000,005D17B6), ref: 005D16FB
GetLastError.KERNEL32(00000000,00000000,005D17B6), ref: 005D1707

Part of subcall function 004266E0: FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,0042B39A,?,00429642,00000000,004296A3,?,?), ref: 00426704
Part of subcall function 004266E0: LocalFree.KERNEL32(?,0042675D,00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,0042B39A,?,00429642,00000000,004296A3), ref: 00426750

FreeLibrary.KERNEL32(00000000,00000000,CreateObject,00000000,00000000,005D17B6), ref: 005D1763

Strings

%s is not a 7z library, xrefs: 005D1778
Library not found %s %d %s, xrefs: 005D16D9
Error loading library %s %d %s, xrefs: 005D1726
CreateObject, xrefs: 005D173C

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLibrary$FormatLoadLocalMessage
String ID: %s is not a 7z library$CreateObject$Error loading library %s %d %s$Library not found %s %d %s
API String ID: 580709419-3365780041
Opcode ID: 19c442717e5e86e4e39c4c9da5dc6f639504a4a509486b6a2ceaf43ed7a96aa5
Instruction ID: cab80f57db70c6f1f85ba4adbc82e016c1c22b957677c792b53b19dfdf140254
Opcode Fuzzy Hash: 19c442717e5e86e4e39c4c9da5dc6f639504a4a509486b6a2ceaf43ed7a96aa5
Instruction Fuzzy Hash: BB712874E00249EFCB10EFA9D981ADDBBF0BF08304F50816AE514A7352DBB9AD45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0080C254, Relevance: 16.7, APIs: 1, Strings: 10, Instructions: 176COMMON

Download Yara Rule

APIs

Part of subcall function 004C93E0: SetLastError.KERNEL32(00000000,00000000,004C9486,?,00000000,00000000,00000000,?,0080C305,00000000,0080C4D0,?,00000007,00000000,00000000), ref: 004C940E
Part of subcall function 004C93E0: GetTempFileNameW.KERNEL32(00000000,tmp,00000000,00000000,00000000,00000000,004C9486,?,00000000,00000000,00000000,?,0080C305,00000000,0080C4D0), ref: 004C942B
Part of subcall function 004C93E0: GetLastError.KERNEL32(00000000,tmp,00000000,00000000,00000000,00000000,004C9486,?,00000000,00000000,00000000,?,0080C305,00000000,0080C4D0), ref: 004C9434

Part of subcall function 009798C0: GetLastError.KERNEL32(?,00000000,00979977), ref: 009798FA

GetLastError.KERNEL32(00000000,00000000,0080C4D0,?,00000007,00000000,00000000,?,0084C1E3,?,?,?,00000000,00000001,?), ref: 0080C489

Part of subcall function 009798C0: Sleep.KERNEL32(000003E8,00000000,00979977), ref: 0097994C

Part of subcall function 00981504: LoadLibraryW.KERNEL32(kernel32.dll), ref: 0098151C
Part of subcall function 00981504: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process,kernel32.dll), ref: 00981545

Strings

010-client-start, xrefs: 0080C2DB
Copy failed, xrefs: 0080C48F
_collect, xrefs: 0080C308
020-client-not-allowed, xrefs: 0080C2EE
\sqlite3.dll, xrefs: 0080C3A0, 0080C3B1
\stub64.exe, xrefs: 0080C443, 0080C454
StartDriversCollecting, xrefs: 0080C494
050-client-copy-failed, xrefs: 0080C4A3
\7z.dll, xrefs: 0080C3EF, 0080C400
c:\debug.pc, xrefs: 0080C295

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$CurrentFileLibraryLoadNameProcessSleepTemp
String ID: 010-client-start$020-client-not-allowed$050-client-copy-failed$Copy failed$StartDriversCollecting$\7z.dll$\sqlite3.dll$\stub64.exe$_collect$c:\debug.pc
API String ID: 1425072028-2691431562
Opcode ID: aa6849467878509fcb3e3a9b1b5c8e3b94dba89a80ef66694ab11f2132df8fe7
Instruction ID: a0e3c72046b9147c0715cf527389f634104f3c62d5aa8e7e657b2dc56508a980
Opcode Fuzzy Hash: aa6849467878509fcb3e3a9b1b5c8e3b94dba89a80ef66694ab11f2132df8fe7
Instruction Fuzzy Hash: 7F615A35A102099BCB50EFA8ED81ADD73B5FF85304F508266F510EB3A6DB34AD09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00981314, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 009813BA
GetLastError.KERNEL32(Text,00000000,00000000,00000000,?,00000000), ref: 009813CE
WriteFile.KERNEL32(00000000,009D06B2,00000002,?,00000000,00000000,00000000,00000000,?,00000000), ref: 009813F9
GetLastError.KERNEL32(Eof,00000000,009D06B2,00000002,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0098140D

Strings

WriteFile fail, xrefs: 009813D4, 00981413
Invalid handle, xrefs: 00981354
XFile.WriteLnW, xrefs: 00981359, 009813D9, 00981418
Eof, xrefs: 00981408
Text, xrefs: 009813C9

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: Eof$Invalid handle$Text$WriteFile fail$XFile.WriteLnW
API String ID: 442123175-1343911282
Opcode ID: d428414ea28d11e19e5490b49ae6f8b9b28af54c46dc8881487c7bf34eb9b5cc
Instruction ID: a44add6d6751e14cb05ce37e87c8c8167f21cfea4fbfbb761e84a0584c5751df
Opcode Fuzzy Hash: d428414ea28d11e19e5490b49ae6f8b9b28af54c46dc8881487c7bf34eb9b5cc
Instruction Fuzzy Hash: 32314F70A00309AFDB10FBA5C942BAEB7BDAB44708F50456AA100E77A2D6789A42C755

Uniqueness

Uniqueness Score: -1.00%

Function 00506614, Relevance: 15.2, APIs: 10, Instructions: 203COMMON

Download Yara Rule

APIs

SaveDC.GDI32(?), ref: 00506632

Part of subcall function 004FE080: GetWindowOrgEx.GDI32(?), ref: 004FE08E
Part of subcall function 004FE080: SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 004FE0A4

IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 0050666B
GetWindowLongW.USER32(00000000,000000EC), ref: 0050667F
GetWindowLongW.USER32(00000000,000000F0), ref: 005066A0
SetRect.USER32 ref: 0050670A
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 0050676E

Part of subcall function 00506558: SaveDC.GDI32(?), ref: 00506569
Part of subcall function 00506558: ExcludeClipRect.GDI32(?,?,?,?,?,00000000,005065F6,?,?,00000000), ref: 005065AA
Part of subcall function 00506558: RestoreDC.GDI32(?,?), ref: 005065F0

SetRect.USER32 ref: 0050678F
DrawEdge.USER32(?,?,00000000,00000000), ref: 0050679E
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 005067C7
RestoreDC.GDI32(?,?), ref: 00506846

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Rect$ClipWindow$Intersect$LongRestoreSave$DrawEdgeExclude
String ID:
API String ID: 3997055466-0
Opcode ID: 42de02813c43ddfe058467e164245deaefac8a815d9e56398bb3a79280a76117
Instruction ID: b305a1ed2a2542e412c6cd267cf26a291a5cd2e341e7880e1b9dfc064cea8f18
Opcode Fuzzy Hash: 42de02813c43ddfe058467e164245deaefac8a815d9e56398bb3a79280a76117
Instruction Fuzzy Hash: ED71F875A00209AFDB10EB98C985FAEBBF9FF48304F104195B904EB292CB75EE51DB54

Uniqueness

Uniqueness Score: -1.00%

Function 005B01A8, Relevance: 15.1, APIs: 10, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 005B0219
GetWindowLongW.USER32(00000000,000000EC), ref: 005B022B
GetClassLongW.USER32(00000000,000000E6), ref: 005B023E
SetWindowLongW.USER32(00000000,000000F0), ref: 005B027E
SetWindowLongW.USER32(00000000,000000EC,?), ref: 005B0292
SetClassLongW.USER32(00000000,000000E6,?), ref: 005B02A6
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 005B02E0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 005B02F8
GetSystemMenu.USER32(00000000,000000FF,00000000,000000EC,?,?,00000000,000000EC,00000000,000000F0), ref: 005B0307
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037,00000000,000000EC,?,?,00000000,000000EC,00000000,000000F0), ref: 005B0330

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Long$Window$ClassMessageSend$MenuSystem
String ID:
API String ID: 494549727-0
Opcode ID: 797703020e0a977370fc73522bd06c6d004e9bfdbb2815b76a13ccd702bbc305
Instruction ID: 99e98a5fddd75b1b189dd9ae562d6f819cfd40e134ab87e5ec21012834bc5fa5
Opcode Fuzzy Hash: 797703020e0a977370fc73522bd06c6d004e9bfdbb2815b76a13ccd702bbc305
Instruction Fuzzy Hash: BA41C430308A4126D616B7398D4EFFF6A9A3FC1314F1C4A19B4949B2D2CF78AC46D355

Uniqueness

Uniqueness Score: -1.00%

Function 007566D4, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Setupapi.dll), ref: 007566F1

Part of subcall function 0041208C: GetProcAddress.KERNEL32(?,?), ref: 004120B0

SetupDiGetDevicePropertyW.SETUPAPI(?,?,?,?,?,?,?,?), ref: 0075673B
GetLastError.KERNEL32 ref: 0075674A

Strings

SetupDiGetDeviceProperty, xrefs: 0075676C, 0075678B
Setupapi.dll, xrefs: 007566EC
SetupDiGetDevicePropertyVar fail, xrefs: 00756767
SetupDiGetDeviceProperty not exists, xrefs: 00756786
SetupDiGetDevicePropertyW, xrefs: 007566FF

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressDeviceErrorLastLibraryLoadProcPropertySetup
String ID: SetupDiGetDeviceProperty$SetupDiGetDeviceProperty not exists$SetupDiGetDevicePropertyVar fail$SetupDiGetDevicePropertyW$Setupapi.dll
API String ID: 698692124-3638961544
Opcode ID: b3049447f54b941de9fe722412e5ee2e6c66bcaf2c4e95f46ba41185fde49198
Instruction ID: ac875c116a709666fdf0ad2eebfcb06f6c0d0521ec67c0eef15ee2765eb163c5
Opcode Fuzzy Hash: b3049447f54b941de9fe722412e5ee2e6c66bcaf2c4e95f46ba41185fde49198
Instruction Fuzzy Hash: 6D2141B0901209DFCB14DFA8C945BEF77F4EB0C315F504525BA14E7250D7B8AA84DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6A4, Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040E75C

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 230b2edc2d8e5689b1012c0d153b57af4d3739b9390f75450c681af2d5146019
Instruction ID: 952a97e85d2106704a2c17765baf1861159145f213fb4572cfefdbf0851cf753
Opcode Fuzzy Hash: 230b2edc2d8e5689b1012c0d153b57af4d3739b9390f75450c681af2d5146019
Instruction Fuzzy Hash: DAA1A1729103099FDB14DFAAD880BDEB7B5BB48310F14892AE545BB390DB74A941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00798390, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 126comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 007983DB

Strings

winmgmts:{impersonationlevel=Impersonate,(Backup,Restore)}!root/wmi:BcdStore, xrefs: 007983E4
AllowPrereleaseSignatures, xrefs: 007984A8, 007984C6
{fa926493-6f1c-4193-a414-58f0b2456d1e}, xrefs: 00798429
OpenStore fail, xrefs: 007984C1
OpenObject fail, xrefs: 007984A3

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: AllowPrereleaseSignatures$OpenObject fail$OpenStore fail$winmgmts:{impersonationlevel=Impersonate,(Backup,Restore)}!root/wmi:BcdStore${fa926493-6f1c-4193-a414-58f0b2456d1e}
API String ID: 2538663250-3365513819
Opcode ID: b9d3bfb483ce28c6292104d27f7779cb6e8ab599c036094d4cbfb4bccd374984
Instruction ID: 81bfa7852e4f25bd4f7d56a0c368ca8cac8ac9152f5f60dadad32e418d0c3877
Opcode Fuzzy Hash: b9d3bfb483ce28c6292104d27f7779cb6e8ab599c036094d4cbfb4bccd374984
Instruction Fuzzy Hash: 034196719041489ADF50EB90EC41FDE77BCDF0A714F914076F500A7292EE78AA09C766

Uniqueness

Uniqueness Score: -1.00%

Function 00755274, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3(10896459,00000000,000000FF,?,?,00000000,0075531B), ref: 007552A8
sqlite3_step.SQLITE3(00000000,?,?,00000000,0075531B), ref: 007552DE
sqlite3_finalize.SQLITE3(00000000,00755322,0075531B), ref: 00755314

Part of subcall function 007550D8: sqlite3_errcode.SQLITE3(?,00000000,007551F9,?,00000000), ref: 0075511A
Part of subcall function 007550D8: sqlite3_errmsg.SQLITE3(?,00000000,007551F9,?,00000000), ref: 0075512B

Strings

e, xrefs: 007552E7
Error executing SQL statement, xrefs: 007552F0
Error executing SQL, xrefs: 007552B7
Could not prepare SQL statement, xrefs: 007552CD

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: sqlite3_errcodesqlite3_errmsgsqlite3_finalizesqlite3_preparesqlite3_step
String ID: Could not prepare SQL statement$Error executing SQL$Error executing SQL statement$e
API String ID: 3909180211-3975281705
Opcode ID: 2905a94396ef827c9b520f2546be5d8c7ae247f44aed0988c05062efb9a606a4
Instruction ID: 2109cf429b8c22ce6462e1c2a19fceb6da7acbd03b26c3142d94b38ed46e55e2
Opcode Fuzzy Hash: 2905a94396ef827c9b520f2546be5d8c7ae247f44aed0988c05062efb9a606a4
Instruction Fuzzy Hash: 921121B1D00648EFCB14DBA8C8659DDB7B8EB44316F2144A5F814A7691D7B89E48CB50

Uniqueness

Uniqueness Score: -1.00%

Function 007AF75C, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

SetupDiGetClassDescriptionW.SETUPAPI(?,?,?,?,00000000,007AF896,?,?,?), ref: 007AF7EA
GetLastError.KERNEL32(?,?,?), ref: 007AF805

Strings

GUID=, xrefs: 007AF830
GetFriendlyClassName, xrefs: 007AF84A
SetupDiGetClassDescription fail, xrefs: 007AF845
Unknown, xrefs: 007AF85C

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ClassDescriptionErrorLastSetup
String ID: GUID=$GetFriendlyClassName$SetupDiGetClassDescription fail$Unknown
API String ID: 3263770665-2576105542
Opcode ID: e0e680921617914f003de2b95b7022a7713af49f3ab761ed0809a6bc3d36584a
Instruction ID: 69741791cbbc23d7c9cedf2022e9302849e78e4dc09db60c27b95d2ecd1e965b
Opcode Fuzzy Hash: e0e680921617914f003de2b95b7022a7713af49f3ab761ed0809a6bc3d36584a
Instruction Fuzzy Hash: 98316D75A0021A9FCB20DF99C881AAEB7F9FF89304F4041BAE408A7750D778AE44DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0097D490, Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 170COMMON

Download Yara Rule

APIs

Part of subcall function 005D3F64: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005D3F75

Part of subcall function 00424AF0: GetLocalTime.KERNEL32(?), ref: 00424AF8

Part of subcall function 005D3F84: Process32FirstW.KERNEL32(000000FF,?), ref: 005D3F95

CloseHandle.KERNEL32(000000FF), ref: 0097D6AE

Part of subcall function 0097ECB0: OpenProcess.KERNEL32(00000410,00000000,00000000,00000000,0097EFBE), ref: 0097ED27
Part of subcall function 0097ECB0: QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,0000020A,00000410,00000000,00000000,00000000,0097EFBE), ref: 0097ED5B
Part of subcall function 0097ECB0: CloseHandle.KERNEL32(00000000,00000000,00000000,?,0000020A,00000410,00000000,00000000,00000000,0097EFBE), ref: 0097ED7B

Strings

Visible=, xrefs: 0097D63F
, xrefs: 0097D5FF
Parent=, xrefs: 0097D61F
---------------------------------------, xrefs: 0097D51C
Start=, xrefs: 0097D666

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess$CreateFirstFullImageLocalNameOpenProcess32QuerySnapshotTimeToolhelp32
String ID: $ Parent=$ Start=$ Visible=$ ---------------------------------------
API String ID: 2763704681-253325831
Opcode ID: f6bd947a4197b872526d5bbb3eb1546710fb12b60f336505748ff49818c20275
Instruction ID: 8880f0b78f542825acc02780dd712d6d0a8829bd4ee421ab64ddaea51f81d1f6
Opcode Fuzzy Hash: f6bd947a4197b872526d5bbb3eb1546710fb12b60f336505748ff49818c20275
Instruction Fuzzy Hash: 12616A75A0221A9FCB14EF94DC45AEEB7B5FF88308F1084AAE408B3251DB755E45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004220C4, Relevance: 9.1, APIs: 6, Instructions: 83fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,?,?,00000000,0097BB75), ref: 004220DA
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,00000000,0097BB75), ref: 00422119
CloseHandle.KERNEL32(00000000,00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,00000000,0097BB75), ref: 00422124
GetLastError.KERNEL32(00000000,?,?,?,?,00000000,0097BB75), ref: 0042216B

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCreateErrorHandleLast
String ID:
API String ID: 2927643983-0
Opcode ID: ae14985c30633f3b9e3b9e2aceddc16e58616b3b44caea32fa216af43c5ee0b5
Instruction ID: 42504638dff81c01478ff505a3a8c0fcaaaacdb9621f118f2cb89acc469e908e
Opcode Fuzzy Hash: ae14985c30633f3b9e3b9e2aceddc16e58616b3b44caea32fa216af43c5ee0b5
Instruction Fuzzy Hash: 2311B23174523434F63815697E96FBF11084B06324FB90A27FB65BA2D5C1DC9EB2605E

Uniqueness

Uniqueness Score: -1.00%

Function 009847FC, Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00984BA6

Strings

%s %s, xrefs: 00984B39
Multiple errors: %s Count: %d, xrefs: 009849B2
%userpath%, xrefs: 009848CA
%s : Multiple logs: %s Count: %d, xrefs: 00984A87

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentThread
String ID: %s %s$%s : Multiple logs: %s Count: %d$%userpath%$Multiple errors: %s Count: %d
API String ID: 2882836952-4227814390
Opcode ID: e614976c58c789b9e28e2382212cd7ce940484a8343195d75ed57a2524eb87b5
Instruction ID: 74d0ec980c0ed3383c04ed1365e7d749f4794d0e0b623e84d239f37a5bfb81e3
Opcode Fuzzy Hash: e614976c58c789b9e28e2382212cd7ce940484a8343195d75ed57a2524eb87b5
Instruction Fuzzy Hash: 17E14A30A0424A9FCB10EFA9D984BDDBBF5FF44314F60816AE440AB362DB34AE45DB55

Uniqueness

Uniqueness Score: -1.00%

Function 004056B8, Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00405684), ref: 0040576F
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00405684), ref: 00405785
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00405684), ref: 004057B3
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00405684), ref: 004057C9

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f49fce9b65db8dc9ecdbc1590d480fa5b75ef117543f621fb4ce1dd8d16e77d1
Instruction ID: 63c3f9fc2a23cd785083252eb645855cb1551ca982d1c43943d10bb728d9629f
Opcode Fuzzy Hash: f49fce9b65db8dc9ecdbc1590d480fa5b75ef117543f621fb4ce1dd8d16e77d1
Instruction Fuzzy Hash: 84C14772616A108FDB25CF29E984317BBE1EB95311F18827FD444AB3D1C3789881DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 007568D8, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 007566D4: LoadLibraryW.KERNEL32(Setupapi.dll), ref: 007566F1
Part of subcall function 007566D4: SetupDiGetDevicePropertyW.SETUPAPI(?,?,?,?,?,?,?,?), ref: 0075673B
Part of subcall function 007566D4: GetLastError.KERNEL32 ref: 0075674A

GetLastError.KERNEL32(00000000,?,00000FD0,?,?,00000000,00756A8D,?,?,?), ref: 007569F9

Strings

,, xrefs: 007569C1
ReadDeviceStringProperty, xrefs: 00756A60
SetupDiGetDeviceProperty fail, xrefs: 00756A5B
ERROR: , xrefs: 00756A10

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLast$DeviceLibraryLoadPropertySetup
String ID: ,$ERROR: $ReadDeviceStringProperty$SetupDiGetDeviceProperty fail
API String ID: 267582115-2712009917
Opcode ID: b00a0d2bf46411cf87a33d7988b70725155ef1ab9c7afdeece2f6c28b3d5abdd
Instruction ID: 3f86afe9d633d2b598866c5f57172a6254327c6b4c25041a4704b6bc6e352e2e
Opcode Fuzzy Hash: b00a0d2bf46411cf87a33d7988b70725155ef1ab9c7afdeece2f6c28b3d5abdd
Instruction Fuzzy Hash: 57419070D002599FDB10DF95CC45AEEB7B5EF48305F8084AAE904F7290D7B8AE89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0042202C, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D
GetLastError.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 00422096

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: d3b263599ba079700f4247df7884bc5872b5e60499887d21a01b57ac9247b397
Instruction ID: ea73ddf321e102643fa493cb3c86e39c8a10444d63d624ae0d132597932a2626
Opcode Fuzzy Hash: d3b263599ba079700f4247df7884bc5872b5e60499887d21a01b57ac9247b397
Instruction Fuzzy Hash: 0101BC3534023071EA3524792F86BBB41440B567A8FA80617FB12A72E2D7CE5883E16F

Uniqueness

Uniqueness Score: -1.00%

Function 004224B8, Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,?,?,00000000,0097BADA), ref: 004224C8
GetLastError.KERNEL32(00000000,?,?,?,00000000,0097BADA), ref: 004224D7
GetFileAttributesW.KERNEL32(00000000,00000000,?,?,?,00000000,0097BADA), ref: 004224DF
RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,?,00000000,0097BADA), ref: 004224FA
SetLastError.KERNEL32(00000000,00000000,00000000,?,?,?,00000000,0097BADA), ref: 00422508

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorFileLast$AttributesDeleteDirectoryRemove
String ID:
API String ID: 2814369299-0
Opcode ID: faff08a3d6ca9d9b95671e769a703ddb82c1cece7a41834bd1e805e456aedb6e
Instruction ID: e306ca6f9c8d4864558ae8baad4498ced178c69cbe5a65039468ec139708e13a
Opcode Fuzzy Hash: faff08a3d6ca9d9b95671e769a703ddb82c1cece7a41834bd1e805e456aedb6e
Instruction Fuzzy Hash: ECF027213012643AA520397E2E91ABF214CC94236DF40063BFA40D3292C69E9EC6616E

Uniqueness

Uniqueness Score: -1.00%

Function 004A7008, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(004A5334,00000004,004A5330,?,?,?,?,?,?,?,?,?,?,00000000,004A70DE), ref: 004A7080
GetCurrentThread.KERNEL32 ref: 004A70B8
GetCurrentThreadId.KERNEL32 ref: 004A70C0

Strings

tEA, xrefs: 004A709F

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentThread$ErrorLast
String ID: tEA
API String ID: 4172138867-544003032
Opcode ID: 5f1cee84e75dedbdd4eaa012c8300aa55e505eef6cc88327e2d6d4e63e515f6f
Instruction ID: c4c95b402820917370fc5874d94c939630ce62c4f1bbe14d2674cbb6d5b69740
Opcode Fuzzy Hash: 5f1cee84e75dedbdd4eaa012c8300aa55e505eef6cc88327e2d6d4e63e515f6f
Instruction Fuzzy Hash: E5216630A0C645AEC720EBB68C417ABBBA4BF66304F44C52BE41097781DB7C9814C79D

Uniqueness

Uniqueness Score: -1.00%

Function 0042F350, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042F35F

Strings

`B, xrefs: 0042F3A0

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID: `B
API String ID: 1473721057-3602356314
Opcode ID: 05ec16b7d08e9c04e28110c5ed772fbbb4933b034d59fb55aaf3e3644485cf9c
Instruction ID: 0f04abc276279d13ed2996c086ff4464770d7b5fd7e08926521cd607af25b040
Opcode Fuzzy Hash: 05ec16b7d08e9c04e28110c5ed772fbbb4933b034d59fb55aaf3e3644485cf9c
Instruction Fuzzy Hash: 4D015231B1413486CB10EB35E9C56A923B5AF55308BF4447BAC06AB256CB2DCC4ED3AF

Uniqueness

Uniqueness Score: -1.00%

Function 00554688, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00000001,00000000,00554707,?,?,00000000,00000000,?,00554721,00883ED2,?,?,?,00000000,?), ref: 005546A5
SetTimer.USER32(?,00000001,?,00000000), ref: 005546C7

Part of subcall function 0040E310: LoadStringW.USER32(00000000,00010000,00001000,00001000), ref: 0040E355

Strings

0NG, xrefs: 005546E2
<L, xrefs: 005546D3

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Timer$KillLoadString
String ID: 0NG$<L
API String ID: 1423459280-3815794942
Opcode ID: f0a07b625004bbf52ee4334d0e2a1442b276dccc9aec96031652c107ced1913e
Instruction ID: c7a4a04000c9651abf54f03d6770b2b9bf0b51777f0e7ba880c1d2d28dea9282
Opcode Fuzzy Hash: f0a07b625004bbf52ee4334d0e2a1442b276dccc9aec96031652c107ced1913e
Instruction Fuzzy Hash: 9501D430604200BBDB25DF65CD92B993BA8EB45788F4004ABFD009B696D7B6AC94CE54

Uniqueness

Uniqueness Score: -1.00%

Function 004AA500, Relevance: 6.1, APIs: 4, Instructions: 59registryCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32 ref: 004AA521
UnregisterClassW.USER32 ref: 004AA54A
RegisterClassW.USER32 ref: 004AA554
SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 004AA59F

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: dc12b4e33490914fb02dd3e52ba5da10e5bdc8520a8571fd547d0d173ba523d0
Instruction ID: bbf5e476866effaa14e3a21b0f827a55b381a23e7ac050eed4fa53bae73306b9
Opcode Fuzzy Hash: dc12b4e33490914fb02dd3e52ba5da10e5bdc8520a8571fd547d0d173ba523d0
Instruction Fuzzy Hash: 9001C2316542086BCB01EBE9DC41F9A73A8AB1A314F004222F980E7391DB39D998D39D

Uniqueness

Uniqueness Score: -1.00%

Function 005B744C, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnumWindows.USER32(005B7388), ref: 005B7479
GetWindow.USER32(00000003,00000003), ref: 005B7491
GetWindowLongW.USER32(00000000,000000EC), ref: 005B749E
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000213,00000000,000000EC), ref: 005B74DD

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: 8113ef21bdb22f61011c7d7a9886f77d5659e8ef27a5aa1ff26cc21bfd694f2f
Instruction ID: 76d0135fcf705c16a5318437db928dea6f67fe8ed73d6141e8f092f279eadfde
Opcode Fuzzy Hash: 8113ef21bdb22f61011c7d7a9886f77d5659e8ef27a5aa1ff26cc21bfd694f2f
Instruction Fuzzy Hash: E0119E30608710AFDE20AA188C85FD67A98AB89725F144169F998EB1D2C670AC818761

Uniqueness

Uniqueness Score: -1.00%

Function 0098550C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,00985621), ref: 009855CC
CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,00985621), ref: 009855E7

Strings

_prev.log, xrefs: 0098558F

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$Copy$Attributes
String ID: _prev.log
API String ID: 493320244-2189240519
Opcode ID: 476c3ce5af7376093ebf443d6a65461836c4da9a9a9cfa9e87ecf20cb7fce739
Instruction ID: 84762afd3cc0f702a749e86a3577186cf098b3d074efd1ab05bba452fb3ce8fb
Opcode Fuzzy Hash: 476c3ce5af7376093ebf443d6a65461836c4da9a9a9cfa9e87ecf20cb7fce739
Instruction Fuzzy Hash: 41314F70A04609EFDB04FFA9D942A9DBBF9EF44304F5241A6F404A73A1D734AE45DB44

Uniqueness

Uniqueness Score: -1.00%

Function 005D282C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,GetHandlerProperty), ref: 005D287D

Strings

GetHandlerProperty, xrefs: 005D2856
%s is not a Format library, xrefs: 005D2892

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: %s is not a Format library$GetHandlerProperty
API String ID: 3664257935-1804726876
Opcode ID: da92d2c4c79cc776e3dc61426b4bac167939efcfcce8b96db899d2c3002778d8
Instruction ID: 687b7a7722579d7cc89d03fac911e9588bab17434cc057d7677b0eef5196fa8a
Opcode Fuzzy Hash: da92d2c4c79cc776e3dc61426b4bac167939efcfcce8b96db899d2c3002778d8
Instruction Fuzzy Hash: 33219A35E00208EFCB10DFA8C941ACEBBF5AF45314F0441AAE804AB342DB76AF40DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0053A27C, Relevance: 4.6, APIs: 3, Instructions: 136windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000000B,00000000,00000000), ref: 0053A305
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 0053A343

Part of subcall function 00538B08: SendMessageW.USER32(00000000,0000101D,?,00000000), ref: 00538B84

SendMessageW.USER32(00000000,0000000B,00000001,00000000), ref: 0053A3D8

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3a99a0d623f2a947fdf1ac0dbfa6fba17a933df7884a2b6956a46ebb58582a20
Instruction ID: 58ba22c1e9b4eddf99a6b0c66b904fbe0505939b108789854d21270c6a445e08
Opcode Fuzzy Hash: 3a99a0d623f2a947fdf1ac0dbfa6fba17a933df7884a2b6956a46ebb58582a20
Instruction Fuzzy Hash: 974108347002059FDB01DB69C989F99BBE4BF89710F6A85A5F848EB3A2C774ED019B41

Uniqueness

Uniqueness Score: -1.00%

Function 005B96DC, Relevance: 4.6, APIs: 3, Instructions: 103timethreadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005B9650: GetCursorPos.USER32 ref: 005B9657

SetTimer.USER32(00000000,00000000,00000000,00000000), ref: 005B97C7

Part of subcall function 005B9D30: InterlockedExchange.KERNEL32(00000012,00000000), ref: 005B9D41

GetCurrentThreadId.KERNEL32 ref: 005B9801
WaitMessage.USER32 ref: 005B9825

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CurrentCursorExchangeInterlockedMessageThreadTimerWait
String ID:
API String ID: 3435799073-0
Opcode ID: e3e523fa21f61f43ecd21db2051b5a33c263c9aade69e0291c23eb70454c8d85
Instruction ID: f5cde8fac7f899e37c08298b3992184c0088438fc4caed502e66f13e8386e1e1
Opcode Fuzzy Hash: e3e523fa21f61f43ecd21db2051b5a33c263c9aade69e0291c23eb70454c8d85
Instruction Fuzzy Hash: 5A418134A18248EFDB11DFA4D889BDDBBF5FB0A304F6184BAE50497291DB746E40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0042861C, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,004286F2,?,00000000), ref: 0042865E
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,004286D5,?,00000000,?,00000000,004286F2,?,00000000), ref: 00428693
VerQueryValueW.VERSION(?,00428704,?,?,00000000,?,00000000,?,00000000,004286D5,?,00000000,?,00000000,004286F2), ref: 004286AD

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: c9272ceec9658206d20ab1a5d43b66d157088d89555c5db9674298815def7519
Instruction ID: 968042cbfdc97b37779c393a7d499e0aed7defdad81797cafccd140475679ddc
Opcode Fuzzy Hash: c9272ceec9658206d20ab1a5d43b66d157088d89555c5db9674298815def7519
Instruction Fuzzy Hash: 47217471B04219AFDB01DFA5DD9199EB3FDEB48314B91447AF400E3691EB78EE10D618

Uniqueness

Uniqueness Score: -1.00%

Function 00985490, Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000000,00000000,?,?,00000000), ref: 009854B9
GetFileSize.KERNEL32(000000FF,00000000,00000000,009854F6), ref: 009854DB
CloseHandle.KERNEL32(000000FF,000000FF,00000000,00000000,009854F6), ref: 009854E7

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: da2f641c7a94cf49dc27b52d02fe47c6c726d1d6c4dd829272d50485dbca52d4
Instruction ID: d6c545e96cd48341d2c82a6ef5c0a127f0270d4c78a16ccf8b4f4e18a08d0a9b
Opcode Fuzzy Hash: da2f641c7a94cf49dc27b52d02fe47c6c726d1d6c4dd829272d50485dbca52d4
Instruction Fuzzy Hash: 0C012631A44304BFEB10DFA9DC46F8EBBACE705724F210566F604EB6D0E6756A409758

Uniqueness

Uniqueness Score: -1.00%

Function 004086C4, Relevance: 4.5, APIs: 3, Instructions: 45sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001,00000000,?,00408A84), ref: 004086F7
Sleep.KERNEL32(00000000,00000000,?,00408A84), ref: 0040870F
SwitchToThread.KERNEL32(00000000,?,00408A84), ref: 00408716

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: Sleep$SwitchThread
String ID:
API String ID: 695535604-0
Opcode ID: c0df57b8419b2083670620c629d658e23e7d114be2cfee9b118d37d723fe75c3
Instruction ID: 0427dd24225b7949a3e88d71367381e5bf1048a9d11473648d4f0a78c1181f41
Opcode Fuzzy Hash: c0df57b8419b2083670620c629d658e23e7d114be2cfee9b118d37d723fe75c3
Instruction Fuzzy Hash: E9F0AF753046108BEF2466689B8072D22C1E796364F21003FE286FB2CADDBD4C42966F

Uniqueness

Uniqueness Score: -1.00%

Function 004A73D8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,00000000,004A7476,?,?,00000000,00000000,?,004A7A8F,006B6E30), ref: 004A740D

Part of subcall function 0040E310: LoadStringW.USER32(00000000,00010000,00001000,00001000), ref: 0040E355

Strings

0nk, xrefs: 004A7417, 004A7424

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: LoadResumeStringThread
String ID: 0nk
API String ID: 2522707468-4197761659
Opcode ID: 6598f620d0fb4ee1f57b2be40e05c488d885096931d54c2ce31463e86c669767
Instruction ID: 1ef9b1c0150c85fdc515c7d2719f6544a6dcd24c1327e240207294be946128e8
Opcode Fuzzy Hash: 6598f620d0fb4ee1f57b2be40e05c488d885096931d54c2ce31463e86c669767
Instruction Fuzzy Hash: 6F11253064C344AFDB20DB61DC92B5A7FA49B5A308F8084ABF8005B382C2BDAC80C758

Uniqueness

Uniqueness Score: -1.00%

Function 004266E0, Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,0042B39A,?,00429642,00000000,004296A3,?,?), ref: 00426704
LocalFree.KERNEL32(?,0042675D,00003300,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,0042B39A,?,00429642,00000000,004296A3), ref: 00426750

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FormatFreeLocalMessage
String ID:
API String ID: 1427518018-0
Opcode ID: 6997aca778c44aa77cea4c5ce964c861b25f665069fee8bb2eabd4239009898d
Instruction ID: d8d8ab1c7a55cccffb2695e12f1d8fcbea57d6c86510f92ad3ab588a006a1a8b
Opcode Fuzzy Hash: 6997aca778c44aa77cea4c5ce964c861b25f665069fee8bb2eabd4239009898d
Instruction Fuzzy Hash: FE012634700314AEE7289A69BC52F7B769DD7C4B48FE100BFB500C72C0DABC9D208668

Uniqueness

Uniqueness Score: -1.00%

Function 0041208C, Relevance: 3.0, APIs: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 004120B0
GetProcAddress.KERNEL32(?,00000000), ref: 004120D2

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 99b6045b3a6b9f017f32236c34c783bd0af6529556a434a6d0e49265cce80da4
Instruction ID: 13501311de8b34c05c245211d8a0b73c91e1b276a843aca21d112aefe7b35c8a
Opcode Fuzzy Hash: 99b6045b3a6b9f017f32236c34c783bd0af6529556a434a6d0e49265cce80da4
Instruction Fuzzy Hash: 38F09630704208BFD711EA55CD42A9E779CEB4D714F51417AFA00E3282D6B86D61C5A9

Uniqueness

Uniqueness Score: -1.00%

Function 00422478, Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,00000000,004C82B3,00000000,004C82D4,?,?,00000000,004C830A,?,?,00000000), ref: 00422483
GetLastError.KERNEL32(?,?,00000000,004C82B3,00000000,004C82D4,?,?,00000000,004C830A,?,?,00000000), ref: 00422495

Part of subcall function 0042238C: FileTimeToLocalFileTime.KERNEL32(?), ref: 004223C4
Part of subcall function 0042238C: FileTimeToDosDateTime.KERNEL32 ref: 004223E3

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileTime$DateErrorFindLastLocalNext
String ID:
API String ID: 2103556486-0
Opcode ID: d29f93cc8b93d2885c900ecddf6cccd2aa3027c446a34dc693dc7e4979ae4584
Instruction ID: 0cb1c134dc61021511d0471edc5909eb564960cf913411c01afac16cfed11c2a
Opcode Fuzzy Hash: d29f93cc8b93d2885c900ecddf6cccd2aa3027c446a34dc693dc7e4979ae4584
Instruction Fuzzy Hash: 23C012A2301211678B40FFFA69C1897238C1E0C205354096BBE04CF117DB5CC8509318

Uniqueness

Uniqueness Score: -1.00%

Function 005AD4A0, Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

FlatSB_SetScrollInfo.COMCTL32(00000000,0000001C,0000001C,000000FF,00000000,00000011,00000000), ref: 005AD563

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FlatInfoScroll
String ID:
API String ID: 3347635785-0
Opcode ID: 66b7d8d5b0a2b448af947c9e52771ef0a7362d514ddb89f28606778f5f0c2fd4
Instruction ID: 5e5adc90759720e8540d5ea7612c7b670607165d748d7d40cf983ba30001951b
Opcode Fuzzy Hash: 66b7d8d5b0a2b448af947c9e52771ef0a7362d514ddb89f28606778f5f0c2fd4
Instruction Fuzzy Hash: E9415674A042448FD754DF6DD484AAABBF1BF9E300F2544AAE488D7352D775EA01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004E8654, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetErrorInfo.OLEAUT32(00000000,00000000,00000000,004E876A,?,?,00000003,00000000,00000000,?,004E8780), ref: 004E8685

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorInfo
String ID:
API String ID: 3619768924-0
Opcode ID: 7225f3ed4e5fa71b6eaeed5b575eec9401d75bb35007cdd8814aa58bee0329bb
Instruction ID: 175fb15ca3856768157610dba05872a607cf82090b9baa4a90effc6feab0f85a
Opcode Fuzzy Hash: 7225f3ed4e5fa71b6eaeed5b575eec9401d75bb35007cdd8814aa58bee0329bb
Instruction Fuzzy Hash: 81310A71A00109AFCB00EBA5C881E9FB3F9FF08305F604476F504F7292DA38AE058B69

Uniqueness

Uniqueness Score: -1.00%

Function 0042F404, Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0042F425

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 55cadb42583794850c719e497d1c4b36accf307a81069ee115d0a379588369e4
Instruction ID: f7299321280e51208392f356114c0e8566344882de8bfc0405d1844498e49c65
Opcode Fuzzy Hash: 55cadb42583794850c719e497d1c4b36accf307a81069ee115d0a379588369e4
Instruction Fuzzy Hash: 1E218331B00225AFDB14EFA9E8449AFB7B8EB59704FD04477E800D3351D6BC9A49CA19

Uniqueness

Uniqueness Score: -1.00%

Function 0042F2B4, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042F340

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d035afa2532d5d73c23d9bd63299b15be47ec31bea270000f66b7b5a8a61adf3
Instruction ID: da1b13281f53af0f01db775b97bd65a504be044991a28ecddac43fe20b9cfd5c
Opcode Fuzzy Hash: d035afa2532d5d73c23d9bd63299b15be47ec31bea270000f66b7b5a8a61adf3
Instruction Fuzzy Hash: BF1191657006259BC710EA69E440A6AB3B0EB46318FD0427BED448B201D62D9C4A8369

Uniqueness

Uniqueness Score: -1.00%

Function 004E8204, Relevance: 1.6, APIs: 1, Instructions: 50comCOMMON

Download Yara Rule

APIs

Part of subcall function 004E7E74: CLSIDFromProgID.OLE32(00000000,?,00000000,004E7EC1,?,?,?,00000000,?,004E823E,00000000,004E82A0,?,00000000,004E8312), ref: 004E7EA1

CoCreateInstance.OLE32(?,00000000,00000005,004E8320,00000000,00000000,004E828F,?,00000000,004E82A0,?,00000000,004E8312), ref: 004E8272

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: f8ad78a739924070dd84ce3eced72942fa310564133b445e9d8d4938e76a8285
Instruction ID: 041e969556199208488e6386472c11fbbbe06949ea7da7140c7b7bb5bdde8a2c
Opcode Fuzzy Hash: f8ad78a739924070dd84ce3eced72942fa310564133b445e9d8d4938e76a8285
Instruction Fuzzy Hash: 8B01F530604B44AFDB11AF66CC12D6AB7ACEB0AB00B5204BAF904E2690EA7D5D10D569

Uniqueness

Uniqueness Score: -1.00%

Function 0041311C, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 0041315B

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7a347b9b16f8ba78d5a95bc278a87fbc138e85edcc25971c738e82eb4a3baa1d
Instruction ID: c647617a961f950230406a0169a5469062ecc9df9f8ace5857e973f21dce1f64
Opcode Fuzzy Hash: 7a347b9b16f8ba78d5a95bc278a87fbc138e85edcc25971c738e82eb4a3baa1d
Instruction Fuzzy Hash: 66F092B2604119BF8B80DE9DDC81EDB77ECEB4D2A4B05412AFA0CE7301D634ED118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004C9268, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004C928D

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: afe63ef3f75b32c3018afd39240ed0bb575197f0e9fe40f36989bb1af70c7053
Instruction ID: d4d334028d1898f8b7401537b27f8d419d7b9c8abff989971096e8a4685274d8
Opcode Fuzzy Hash: afe63ef3f75b32c3018afd39240ed0bb575197f0e9fe40f36989bb1af70c7053
Instruction Fuzzy Hash: 51F0AF3E7140116BDB547A79884CBAE72C2DB81369F05497FF5C1C7390C62C8C82C24D

Uniqueness

Uniqueness Score: -1.00%

Function 0053A0A4, Relevance: 1.5, APIs: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000104D,00000000), ref: 0053A0F1

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b516db4ba183dedf43a5ff3e6efd4a76ec61a8c05e8804532e1a07714d173850
Instruction ID: e8dbb46d6c0c0e6be29af5ea7cadee4bdb30249900bad84a6f10e08fbfd23fc5
Opcode Fuzzy Hash: b516db4ba183dedf43a5ff3e6efd4a76ec61a8c05e8804532e1a07714d173850
Instruction Fuzzy Hash: A1F027313006521BD204A12D8C49A6B7BC9FBC9760F140135FD44CF351DE56DD0183D2

Uniqueness

Uniqueness Score: -1.00%

Function 004CB5B8, Relevance: 1.5, APIs: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,004CBB62,?,?,?,?,004CBB62), ref: 004CB5E9

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 61ec06d8b01221c04fd75fe602f73208140e788be0c124307e9c6b7c48eb2c7c
Instruction ID: 822ba114e09c931b725da73c3f825071d6b9070daf3bee6f3cdd93595a4d3e1a
Opcode Fuzzy Hash: 61ec06d8b01221c04fd75fe602f73208140e788be0c124307e9c6b7c48eb2c7c
Instruction Fuzzy Hash: 49F030763082046FD744EA6E9C81F6B66DCDB88714F14843FB249D7242D928DC059376

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E8, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A,00400000,009ACC28,0040C955,0041B4CC,?,?,0040E354,00010000,00001000,00001000), ref: 0040C906

Part of subcall function 0040DB60: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040DC1A,?,00400000,009ACC28,?,0040C914,00400000,?,0000020A,00400000,009ACC28,0040C955), ref: 0040DB9C
Part of subcall function 0040DB60: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040DC1A,?,00400000,009ACC28,?,0040C914,00400000,?,0000020A), ref: 0040DBED

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 541db8c03e8d25627d20ee499dca87d58b2a82bfab76723142b21a629862c834
Instruction ID: 2c0b8d9275144a6f29f6975400dec7db8c3e179cca4e468066f048c90477d369
Opcode Fuzzy Hash: 541db8c03e8d25627d20ee499dca87d58b2a82bfab76723142b21a629862c834
Instruction Fuzzy Hash: 86E0EDB2A003109BCB10DFA8D8C5A4737E8BB08754F044A66AD54DF396D379DD1487D5

Uniqueness

Uniqueness Score: -1.00%

Function 004FF2C8, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000,00000001,005B4BC1,0054E4D0,?,00000000,00000000,00000000,00000000,00000004,00000000,00000004,0000000E), ref: 004FF2E0

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c3ea93101e42d664048c8b0ede39f61794b7c7fc38106d019c75d6ac0a92788e
Instruction ID: d518fc92883324e44afeab308935cbe01f3461d08a982b689833da63c5f27ea1
Opcode Fuzzy Hash: c3ea93101e42d664048c8b0ede39f61794b7c7fc38106d019c75d6ac0a92788e
Instruction Fuzzy Hash: B9E012713007404FD320CA6DC485B83F7E9AF89218F144469E58AC7751C7B4AC08CB50

Uniqueness

Uniqueness Score: -1.00%

Function 004FF370, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000011,005006F0,?,005115E8,00000001,0051A9E3,00000000,00000001,0054E5A5,?,00000000,00000000,00000000,00000000,00000004,00000000), ref: 004FF386

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: da31a29ebbf2f646c8a828a38270fdba124d70558d6c0cc7eb12b1e3830dfe1d
Instruction ID: ec95bf9f7b428eb71b423a9ba453e09a43b2dcccb97dd815f7079515d8b6833d
Opcode Fuzzy Hash: da31a29ebbf2f646c8a828a38270fdba124d70558d6c0cc7eb12b1e3830dfe1d
Instruction Fuzzy Hash: 24E01A35200B404FD320CA6EC485B93FBE9EF89219F04496EE98AC7711C7B4AC08CB60

Uniqueness

Uniqueness Score: -1.00%

Function 004FF338, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(004FEC28,00000041,?,005115E8,00000001,0051A9D7,00000000,00000001,0054E5A5,?,00000000,00000000,00000000,00000000,00000004,00000000), ref: 004FF34E

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 00eeeb9f33879fc7a02cb6166aa6b75850a4c12d3680dd7981267b54be40ccd8
Instruction ID: abc1c1f8246907d9a1abe8f3ef1e7e2879243059477460f5150adc1446b29098
Opcode Fuzzy Hash: 00eeeb9f33879fc7a02cb6166aa6b75850a4c12d3680dd7981267b54be40ccd8
Instruction Fuzzy Hash: 06E048712007404FD320CA6DC485B53F7E9EF86614F04446DE98AC7711C7B4BC09CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0097D450, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

EnumWindows.USER32(0097D40C,00000000), ref: 0097D47A

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 76d6534bc7014f0a67e9f24b3eb502238a2439a9640b1ebb8b3bca8a9a889a86
Instruction ID: 1f09407f59e82469e8c4a9b3a42182d49b451aa01d9b67f028602af3803147ec
Opcode Fuzzy Hash: 76d6534bc7014f0a67e9f24b3eb502238a2439a9640b1ebb8b3bca8a9a889a86
Instruction Fuzzy Hash: 5CE09225A9E3C89DC711CBA86C12BDD7FB14B26110F1400DBD494673D2D1791712E7A7

Uniqueness

Uniqueness Score: -1.00%

Function 004A74C0, Relevance: 1.5, APIs: 1, Instructions: 18threadCOMMON

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?,?,00000000,00985C2D,00000000,00985D63,?,?,?,0098360F,?,?,007B4F2F,?,00000000), ref: 004A74D5

Part of subcall function 004A7258: GetLastError.KERNEL32(00000002,004A74E7,?,?,?,00000000,00985C2D,00000000,00985D63,?,?,?,0098360F,?,?,007B4F2F), ref: 004A725F

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: ErrorLastPriorityThread
String ID:
API String ID: 3452863325-0
Opcode ID: 927def48c0af9031645fc3071d90b52da7a98da3ee8ecd7e04ebfae838c4d6d6
Instruction ID: 6c2e9ac7ef7219837d5d100ae6630acab0508b9c43d8dbe0b0d3ecd4d189ae7d
Opcode Fuzzy Hash: 927def48c0af9031645fc3071d90b52da7a98da3ee8ecd7e04ebfae838c4d6d6
Instruction Fuzzy Hash: 4BD022B37009280F8224E6EEEC90C9AA2CC8F8E20A3008163F048C3220C26DCC4143B4

Uniqueness

Uniqueness Score: -1.00%

Function 0042294C, Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000001,00422272,00000000,00422297,?,00000000,00000000,00000000,00000000,00000000,?,00985730,00000000,0098575F), ref: 00422959

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 022edc40d1803eab289424500c324dc959b6aa0b03df0d20d6716ec6f7b348a9
Instruction ID: f1beff088d7b771a414cfd9033c616504088634d68ad5495b18351c25d83db32
Opcode Fuzzy Hash: 022edc40d1803eab289424500c324dc959b6aa0b03df0d20d6716ec6f7b348a9
Instruction Fuzzy Hash: 1DB092A2B543401AEA0076BA1CC2B2A008C9B0460AF20093AB202D6192D56AD8542069

Uniqueness

Uniqueness Score: -1.00%

Function 005BA72C, Relevance: 1.5, APIs: 1, Instructions: 7windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000000,00000000,00000000), ref: 005BA739

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: afd0fd0557cfa1f03ce01e36faf8a77a274703c27e673350b56bbd56c4d2dde5
Instruction ID: 782f1511d9ac2bb4653bd7654bad791c1443388b174ea97733d217cb72d40237
Opcode Fuzzy Hash: afd0fd0557cfa1f03ce01e36faf8a77a274703c27e673350b56bbd56c4d2dde5
Instruction Fuzzy Hash: 59B011323803003AE820A2A08C0BFC222882B00B00FE000A0B300EF0E2C8E8A0808308

Uniqueness

Uniqueness Score: -1.00%

Function 00985674, Relevance: 1.4, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 0098550C: CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,00985621), ref: 009855CC

Part of subcall function 0042202C: GetFileAttributesW.KERNEL32(00000000,?,?,00000000,0098352C,?,?,00984BA2,?,?,00000011,00000000,00984BF6,?,00000000,00984C53), ref: 0042203D

CloseHandle.KERNEL32(00000000,?,00000000,009858BD,?,00000000,009858D1,?,00000000,009858F4,?,?,?,?,00000000), ref: 009857F9

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCopyHandle
String ID:
API String ID: 3758927242-0
Opcode ID: 04f6433b6d1ea39ee4604d4952d58dcabb22b5c001b1c2f557b709965974abed
Instruction ID: 5ac0434e6ba370ea1e3d7d0e35abea83699f8016806cc0d0838337b737180f42
Opcode Fuzzy Hash: 04f6433b6d1ea39ee4604d4952d58dcabb22b5c001b1c2f557b709965974abed
Instruction Fuzzy Hash: CE713774A04A08DFDB01EF69D89199DBBF8FB8D700B6285A6E800E7760D735AD05DF50

Uniqueness

Uniqueness Score: -1.00%

Function 004AA368, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,?,?,00502FD3,00505550,?,?,?,02A95AE0,?,005AD5D3), ref: 004AA386

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7db192208dbb12fccedcdac80ac930968fd60e87b2f0c5c2f3b86bec7e696011
Instruction ID: da7b2ca7fdd08739f41208bfe49e987d90af6638686082190b257701d7bdcfde
Opcode Fuzzy Hash: 7db192208dbb12fccedcdac80ac930968fd60e87b2f0c5c2f3b86bec7e696011
Instruction Fuzzy Hash: A71188342443059BCB20DF5AC881B82FBE5EB99350F14C53BE9998B385D374E814CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040539C, Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,004059B3,FFFFFFDC,00405684), ref: 004053B3

Memory Dump Source

Source File: 00000009.00000002.930056551.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.930046104.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.930893040.00000000009AC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930912602.00000000009B1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930927378.00000000009B3000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930950118.00000000009B8000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930959635.00000000009B9000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930968987.00000000009BA000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.930978363.00000000009BC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.930990113.00000000009BE000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931018543.00000000009CF000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931033398.00000000009D0000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931048312.00000000009D1000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931062247.00000000009D2000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931080263.00000000009D6000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931096468.00000000009DB000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931110839.00000000009DC000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931124604.00000000009DD000.00000008.00020000.sdmp Download File
Associated: 00000009.00000002.931137259.00000000009E1000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.931152030.00000000009E3000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931168297.00000000009E5000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931291914.0000000000A53000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931423884.0000000000B0B000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.931457804.0000000000B49000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PCHelpSoftDriverUpdater.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b2737d660b630959b3341d650ca1e856526eae68c3af07ee34c8b9b9858b7f4e
Instruction ID: 97e4a82d49b6388c5f67372551d2cfad26a72be00a867e3ee24312c067f26cda
Opcode Fuzzy Hash: b2737d660b630959b3341d650ca1e856526eae68c3af07ee34c8b9b9858b7f4e
Instruction Fuzzy Hash: 22F08CB2B563104BD7248F789D403427BE4F715355F11423FE909EB7D4D77088818B88

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report https://webtools.avanquest.com/download.cfm?go=https://cdn.pchelpsoft.com/pchelpsoft/Driver_Updater.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Function 004A7114, Relevance: 43.9, APIs: 7, Strings: 18, Instructions: 165
libraryloaderCOMMON

Function 004A162C, Relevance: 7.6, APIs: 5, Instructions: 80
memoryCOMMON

Function 0040B3B8, Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Function 0040B268, Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Function 0040AE8C, Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Function 0040426C, Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Function 004A8383, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103
COMMON

Function 004A143C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Function 004A7A8C, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56
COMMON

Function 00403EE8, Relevance: 9.0, APIs: 7, Instructions: 298
sleepCOMMON

Function 004A80CC, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165
windowCOMMON

Function 00407724, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93
threadCOMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre